Interfaces and methods for group policy management

• US 8,117,230 B2
• Filed: 05/12/2009
• Issued: 02/14/2012
• Est. Priority Date: 04/09/2003
• Status: Expired due to Fees

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Shaji, Ullattil, Gupta, Rahul, Cheng, Derek C. Y., Whalen, William J., Tanner, Carey, Treit, Mike A. Jr.
• Primary Examiner(s): Breene, John E
• Assistant Examiner(s): MYINT, DENNIS Y
• Application Number:
  US12/464,108
• Publication Number:
  US 20090222884A1
• Time in Patent Office: 1,008 Days
• Field of Search: 707/786, 707/787
• US Class Current: 707/786
• CPC Class Codes: H04L 41/082 the condition being updates or upgrades of network functionality
• CPC Class Codes: H04L 41/084 Configuration by using pre-existing information, e.g. using templates or copying from other elements
• CPC Class Codes: H04L 41/0856 by backing up or archiving configuration information
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management

Abstract

A system and method for managing group policy objects in a network, including interfaces that allow access by programs or a user interface component to functions of a group policy management console that performs management tasks on group policy objects and other related objects. The interfaces abstract the underlying data storage and retrieval, thereby facilitating searching for objects, and providing the ability to delegate, view, change and permissions on those objects, and check and save those permissions. Modeling and other test simulations are facilitated by other interfaces. Other interfaces provide dynamic and interactive features, such as to convey progress and rich status messages, and allow canceling of an ongoing operation. Still other interfaces provide methods for operating on group policy related data, including group policy object backup, restore, import, copy and create methods, and methods for linking group policy objects to scope of management objects.

Claims

1. In a computing environment, a method comprising:

receiving a request to manage security settings of a group policy data construct;

generating a permissions table based on security information associated with the group policy data construct, wherein each row in the permissions table corresponds to a trustee that is at least one computer or at least one user, and each column in the permissions table corresponds to a directory service permission, wherein a plurality of cells in the permissions table contain data regarding an access state to a directory service, whether the access state is inherited, and whether the access state is inheritable, the access state in one of the plurality of cells of the permissions table being denied and the access state in another of the plurality of the cells of the permissions table being allowed;

changing the permissions table to satisfy the request;

saving security settings to the group policy data construct based on the changed permissions table; and

performing a check of the permissions table to determine whether each access state is either in a state of allowed or in a state of denied.

2. The method of claim 1 wherein the group policy data construct comprises a group policy object.

3. The method of claim 1 wherein the group policy data construct comprises a scope of management object.

4. The method of claim 1 wherein the group policy data construct comprises a WMI filter.

5. The method of claim 1 wherein changing the permissions table includes adding a permission.

6. The method of claim 1 wherein changing the permissions table includes removing a permission.

7. A computer storage medium storing computer-executable instructions that, when executed, cause one or more processors to perform acts comprising:

receiving a request to manage security settings of a group policy data construct;

generating a permissions table based on security information associated with the group policy data construct, wherein each row in the permissions table corresponds to a trustee that is at least one computer or at least one user, and each column in the permissions table corresponds to a directory service permission, wherein a plurality of cells in the permissions table contain data regarding an access state to a directory service, whether the access state is inherited, and whether the access state is inheritable the access state in one of the plurality of cells of the permissions table being denied and the access state in another of the plurality of the cells of the permissions table being allowed;

changing the permissions table to satisfy the request;

saving security settings to the group policy data construct based on the changed permissions table; and

performing a check of the permissions table to determine whether each access state is either in a state of allowed or in a state of denied.

8. The computer storage medium of claim 7 wherein the group policy data construct comprises a group policy object.

9. The computer storage medium of claim 7 wherein the group policy data construct comprises a scope of management object.

10. The computer storage medium of claim 7 wherein the group policy data construct comprises a WMI filter.

11. The computer storage medium of claim 7 wherein changing the permissions table includes adding a permission.

12. The computer storage medium of claim 7 wherein changing the permissions table includes removing a permission.

13. In a computing environment, a method comprising:

receiving a request to manage security settings of a group policy data construct;

generating a permissions table based on security information associated with the group policy data construct, wherein each row in the permissions table corresponds to a trustee that is a computer or a group of computers in a domain, and each column in the permissions table corresponds to a directory service permission, wherein a plurality of cells in the permissions table contain data regarding an access state, whether the access state is inherited, and whether the access state is inheritable;

changing the permissions table to satisfy the request;

saving security settings to the group policy data construct based on the changed permissions table; and

performing a check of the permissions table to determine whether each access state is either in a state of allowed or in a state of denied.