GPO Tatooing

[ZIDAC]

Hi

What is GPO Tatooing and what is the efects in clients?

Any documentations or link ?

Tahnks

[Ace Fekay [Microsoft Certified Trainer]]

Post by ZIDAC
Hi
What is GPO Tatooing and what is the efects in clients?
Any documentations or link ?
Tahnks

Tattooing is the term that some use to define what a GPO (Group Policy Object) does for a client's registry. The effects is that it applies your GPOs to a client in the computer portion (HKLM) and the user portion (HKCU) of the registry. Then when they logoff or shutdown properly, the entries are removed.

Basically there are numerous links on how GPOs work. Here is one for starters. I'm sure others will post additional links for you to read. This one is for Win2000, but they are all exactly the same for all versions, 2000, 2003, 2008 and any newer operating systems that will come out.

Designing Organization-wide Policies
http://technet.microsoft.com/en-us/library/bb742375.aspx

Group Policy
http://en.wikipedia.org/wiki/Group_Policy
--
Ace

This posting is provided "AS-IS" with no warranties or guarantees and
confers no rights.

Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSA Messaging, MCT
Microsoft Certified Trainer
***@mvps.RemoveThisPart.org

For urgent issues, you may want to contact Microsoft PSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

"Efficiency is doing things right; effectiveness is doing the right things." - Peter F. Drucker
http://twitter.com/acefekay

[Phillip Windell]

I thought it was the settings that were not removed if the GPO was removed?
Tatooed as in permanent,... unless you force them back to some other
settings with another GPO or an edited GPO.
--
Phillip Windell

The views expressed, are my own and not those of my employer, or Microsoft,
or anyone else associated with me, including my cats.
-----------------------------------------------------

Post by ZIDAC
Hi
What is GPO Tatooing and what is the efects in clients?
Any documentations or link ?
Tahnks

Tattooing is the term that some use to define what a GPO (Group Policy
Object) does for a client's registry. The effects is that it applies your
GPOs to a client in the computer portion (HKLM) and the user portion (HKCU)
of the registry. Then when they logoff or shutdown properly, the entries are
removed.

Basically there are numerous links on how GPOs work. Here is one for
starters. I'm sure others will post additional links for you to read. This
one is for Win2000, but they are all exactly the same for all versions,
2000, 2003, 2008 and any newer operating systems that will come out.

Designing Organization-wide Policies
http://technet.microsoft.com/en-us/library/bb742375.aspx

Group Policy
http://en.wikipedia.org/wiki/Group_Policy
--
Ace

This posting is provided "AS-IS" with no warranties or guarantees and
confers no rights.

Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSA Messaging, MCT
Microsoft Certified Trainer
***@mvps.RemoveThisPart.org

For urgent issues, you may want to contact Microsoft PSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

"Efficiency is doing things right; effectiveness is doing the right
things." - Peter F. Drucker
http://twitter.com/acefekay

[Ace Fekay [Microsoft Certified Trainer]]

Post by Phillip Windell
I thought it was the settings that were not removed if the GPO was removed?
Tatooed as in permanent,... unless you force them back to some other
settings with another GPO or an edited GPO.

I guess under the NT4 days that's how it was. You had to apply a reverse policy. But the way I look at GPOs is they do tatoo the reg but get removed when logged off or shutdown, so GPOs represent more of a removable tatoo.



Ace

[Phillip Windell]

Ok.
--
Phillip Windell

The views expressed, are my own and not those of my employer, or Microsoft,
or anyone else associated with me, including my cats.
-----------------------------------------------------

Post by Phillip Windell
I thought it was the settings that were not removed if the GPO was removed?
Tatooed as in permanent,... unless you force them back to some other
settings with another GPO or an edited GPO.

I guess under the NT4 days that's how it was. You had to apply a reverse
policy. But the way I look at GPOs is they do tatoo the reg but get removed
when logged off or shutdown, so GPOs represent more of a removable tatoo.



Ace

[Ace Fekay [Microsoft Certified Trainer]]

Ok.

And to add, once I read a post by someone quite a few years back, and I forget who it was, who wondered how the term GPO, or Group Policy Objects, came about. He explained that they don't apply to groups, other than possibly meaning grouping a bunch of policies together, and the name doesn't do it justice or is very descriptive. He went on to explain that they may be better described as "Forced Automatic Registry Templates." But of course we could never use its derived acronym.

:-)

Ace

[Anthony [MVP]]

Ace, its really interesting how the whole AD terminology came about.
Remember Intellimirror?
Anthony
http://www.airdesk.com

Post by Ace Fekay [Microsoft Certified Trainer]

Ok.

And to add, once I read a post by someone quite a few years back, and I
forget who it was, who wondered how the term GPO, or Group Policy Objects,
came about. He explained that they don't apply to groups, other than
possibly meaning grouping a bunch of policies together, and the name
doesn't do it justice or is very descriptive. He went on to explain that
they may be better described as "Forced Automatic Registry Templates." But
of course we could never use its derived acronym.
:-)
Ace

[Ace Fekay [Microsoft Certified Trainer]]

Post by Anthony [MVP]
Ace, its really interesting how the whole AD terminology came about.
Remember Intellimirror?

Yes, I do! Intelimirror was the whole basis, or as it was stated originally, the technology that went into Windows 2000, which the name was changed to Group Policy, to offer centralized user settings control, software distribution, etc. We touched on that in the 2000 beta courseware, and if I remember correctly, was also touched on the "A versions of the original 2000 MOC courseware, then disappeared after that. I haven't heard that term in quite some time.

Cheers!

Ace

[Florian Frommherz [MVP]]

Howdie!

Post by Ace Fekay [Microsoft Certified Trainer]
Yes, I do! Intelimirror was the whole basis, or as it was stated originally, the technology that went into Windows 2000, which the name was changed to Group Policy, to offer centralized user settings control, software distribution, etc. We touched on that in the 2000 beta courseware, and if I remember correctly, was also touched on the "A versions of the original 2000 MOC courseware, then disappeared after that. I haven't heard that term in quite some time.

Actually, Jeremy uses the term in his books (the older ones at least).
It doesn't include Group Policy as a whole, but parts you can control
(Offline Folders, Software Installation, Folder Redirection). The
"Administrative Templates" part - the facility in GP that does nothing
else but change the registry, isn't included there.

From that perspective, it's interesting to see what those components
were back in those days and how management and Group Policy evolved
along the way..

Cheers,
Florian

[Ace Fekay [Microsoft Certified Trainer]]

Post by Florian Frommherz [MVP]
Actually, Jeremy uses the term in his books (the older ones at least).
It doesn't include Group Policy as a whole, but parts you can control
(Offline Folders, Software Installation, Folder Redirection). The
"Administrative Templates" part - the facility in GP that does nothing
else but change the registry, isn't included there.
From that perspective, it's interesting to see what those components
were back in those days and how management and Group Policy evolved
along the way..

Hi Florian!

Originally, it's not that it is specifically controlling or changing the registry, but as it evolved, it came to control certain parts of the reg, at least the parts that affect the user enviornment. It did evolve further to control more parts of the reg, among other things. I found this link on it, but it is dated 2009. I think it was from the original beta or RTM 2000 days, and was just updated as part of the rest of the 2000 Technet section.

Introduction to IntelliMirror
http://technet.microsoft.com/en-us/library/bb742423.aspx

Ace

[Ace Fekay [Microsoft Certified Trainer]]

Post by ZIDAC
Hi
What is GPO Tatooing and what is the efects in clients?
Any documentations or link ?
Tahnks

Here are some more links on tattooing:

GPOGuy - Understanding Policy "Tattooing"
http://www.gpoguy.com/FAQs/Whitepapers/tabid/63/articleType/ArticleView/articleId/5/Understanding-Policy-Tattooing.aspx

GPOGuy - More on registry tattooing--an interesting scenario
http://sdmsoftware.com/blog/2007/10/more_on_registry_tattooingan_i.html

Mark Minasi - GPOs and registry tattooing
http://x220.minasi.com/forum/topic.asp?TOPIC_ID=7729

Ace

[Jorge Silva]

Hi
IMO, Tattoo is something that you not remove without some hard work and
consequences, the same was true back in NT4 days when using GPO, Tattooing
doesn’t apply anymore in earlier systems than NT4. The registry is changed,
it's true, and it's part of the process to configure the system but the
changes are easily reversed (sometimes :))
--
I hope that the information above helps you.
Have a Nice day.

Jorge Silva
MVP Directory Services

Post by ZIDAC
Hi
What is GPO Tatooing and what is the efects in clients?
Any documentations or link ?
Tahnks