System and method for efficient configuration of group policies

• US 20060174320A1
• Filed: 01/31/2005
• Published: 08/03/2006
• Est. Priority Date: 01/31/2005
• Status: Abandoned Application

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Andreiu, Geanina, Oustiougov, Maxim, Maru, Vishal D.
• Application Number:
  US11/048,036
• Publication Number:
  US 20060174320A1
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/105 Multiple levels of security

Abstract

A registry of system information may have several sections. Group policies may be represented by entries in particular sections of the registry. A policy map may map group policies to the sections and entries of the registry. A policy map registry section field of the policy map may specify one or more sections of the registry to which group policies are mapped. The policy map may include one or more registry variable policy map fields, each of which may specify mappings for different types of registry variables. A configuration file repository may include sets and versions of policy configuration files that include policy maps. A group policy configuration tool may retrieve and parse policy maps, and update group policies corresponding to the policy maps.

Claims

1. A computer-implemented method of group policy configuration comprising:

retrieving at least one policy map for mapping at least one group policy to a registry, each policy map comprising a policy map registry section field specifying at least one section of the registry;

parsing said at least one policy map; and

updating said at least one group policy corresponding to said at least one policy map.

2. The method of claim 1, wherein:

the method further comprises;

retrieving at least one policy configuration filename, each policy configuration filename corresponding to a policy configuration file, each policy configuration file comprising said at least one policy map; and

accessing the policy configuration file; and

parsing said at least one policy map comprises parsing the policy configuration file corresponding to said at least one policy configuration filename.

3. The method of claim 1, wherein updating said at least one group policy comprises updating at least one group policy object of a computer operating system.

4. The method of claim 1, wherein:

the registry is a computer operating system registry; and

updating said at least one group policy comprises updating the computer operating system registry.

5. The method of claim 1, wherein:

the method further comprises retrieving a set of references to target computers; and

updating said at least one group policy comprises updating said at least one group policy at each computer referenced by the set of references to target computers.

6. A computerized system for group policy configuration comprising:

a registry of system information comprising a plurality of sections;

at least one policy map for mapping at least one group policy to the registry, each policy map comprising a policy map registry section field specifying at least one of the plurality of sections of the registry; and

a group policy configuration tool configured to, at least;

retrieve said at least one policy map;

parse each policy map; and

update said at least one group policy corresponding to said at least one policy map.

7. The system of claim 6, wherein:

the system further comprises at least one policy configuration file;

said at least one policy configuration file comprises said at least one policy map; and

retrieving said at least one policy map comprises accessing said at least one policy configuration file.

8. The system of claim 6, wherein:

the system further comprises a group policy component object model (COM) object; and

the group policy configuration tool is further configured to update said at least one group policy with the group policy COM object.

9. The system of claim 6, wherein:

the system further comprises a computer operating system comprising;

the registry; and

at least one group policy object capable of specifying each group policy; and

updating said at least one group policy comprises updating said at least one group policy object of the computer operating system.

10. The system of claim 9, wherein:

the computer operating system further comprises a group policy map schema; and

the system further comprises at least one group policy configuration file structured in accordance with the group policy map schema.

11. A computer-readable medium having thereon a data structure for group policy configuration comprising a policy map for mapping at least one group policy to a registry, the policy map comprising:

a policy map description comprising alphanumeric text providing information about the group policy;

a policy map registry section field specifying at least one section of the registry; and

a first registry variable policy map field for mapping at least some of said at least one group policy to a first type of registry variable of the registry.

12. The medium of claim 11, wherein:

the registry comprises a plurality of types of registry variable; and

the policy map further comprises a second registry variable policy map field for mapping at least some of said at least one group policy to a second type of registry variable of the registry.

13. The medium of claim 12, wherein each registry variable policy map field comprises at least one name-value pair associating a registry key name with a registry variable value.

14. The medium of claim 13, wherein the registry key name corresponds to a registry key name in a policy map schema.

15. The medium of claim 11, wherein the policy map further comprises a policy map registry area field specifying at least one of a plurality of areas of the registry, the plurality of areas of the registry comprising:

a local machine area for registry entries associated with a computer; and

a user area for registry entries associated with at least one user of the computer.

16. The medium of claim 11, wherein said at least one group policy comprises a group policy associated with at least one user of a computer.

17. The medium of claim 11, wherein said at least one group policy comprises a group policy specifying security settings.

18. The medium of claim 11, wherein:

the registry comprises a plurality of sections organized in a hierarchy; and

specifying said at least one section of the registry comprises specifying a path through the hierarchy.

19. The medium of claim 11, wherein the policy map comprises extensible markup language.

20. The medium of claim 19, wherein each of the policy map description, the policy map registry section field, and the first registry variable policy map field is an extensible markup language element.