Getting Through the Maze
Active Administrator simplifies Group Policy management.
Active Directory’s Group Policy probably intimidates system administrators
more than any other Windows 2000 feature, including AD itself. The complexity
of Group Policy prevents many IT pros from taking advantage of this powerful
feature—or from upgrading to AD altogether.
Active Administrator, one of many Win2K administrative utilities from
Small Wonders Software, can make the process of Group Policy implementation
much easier. You still need to develop expertise in Group Policy, but
Active Administrator can provide invaluable help when planning, deploying
and troubleshooting Group Policy Objects (GPOs).
Active Administrator boasts a more useable interface for Group Policy
management than Microsoft’s AD Users and Computers. As the figure shows,
the Group Policy Objects tab allows you to select any GPO in the enterprise
and display details about it, including its filter settings and links.
You can create new GPOs, edit the GPO settings (using the Microsoft default
GPO editor), and link the GPO to sites, domains and Organizational Units
Active Administrator includes some much-needed Group Policy features
lacking in Win2K. Among these is the ability to copy GPOs across domains,
which Win2K surprisingly can’t do. Also, Active Administrator can selectively
back up and restore individual GPOs or groups of GPOs (normally, this
would require a full backup of the domain controller’s system state).
Also, the “Group Policy Objects by Container” tab allows you to select
any site, domain or OU and easily list all the GPOs that apply to it,
either through inheritance or direct links.
The powerful Resultant Set of Policy (RSoP) feature is probably worth
the purchase price alone. This invaluable tool allows you to test Group
Policy "what-if" scenarios. Active Administrator can also generate detailed
RSoP reports that, based upon your queries, include a breakdown of the
specific policy settings that will apply to the user and/or computer in
your scenario. (The many different types of reports are another selling
|Active Administrator’s Group Policy Objects display
exposes essential information about a domain’s GPOs.
Active Administrator achieves less success in its goal of completely
replacing Microsoft’s AD administration tools. Active Administrator certainly
does a better job of exposing security settings than AD Users and Computers;
its ability to produce reports on security settings—especially delegated
administrative rights—is invaluable. However, if Small Wonders Software
really wants to convince administrators to forgo AD Users and Computers
altogether, it should add some simple but much needed features that Microsoft’s
snap-ins lack: drag and drop functionality, for example, as well as the
capability to make changes to several directory objects simultaneously.
Still, the fact that I wanted to use Active Administrator instead of
AD Users and Computers speaks to the overall quality of the product. The
utility is definitely worth a look.
Ronald Stewart, MCSE+I, MCT, is an IT consultant in Vancouver, Canada. He has more than 10 years of experience in IT. He’s worked with, consulted on, and taught DNS.