What allows you to deploy GPO settings without restricting users from changing them later?

What allows you to deploy GPO settings without restricting users from changing them later?

• Group Policy Preferences
• Group Policy Prerogative
• Group Policy YesNoMaybe
• Group Policy Choices 

EXPLANATION

Group Policy is a feature of the Microsoft Windows NT family of operating systems that controls the working environment of user accounts and computer accounts. Group Policy provides centralized management and configuration of operating systems, applications, and users' settings in an Active Directory environment. A version of Group Policy called Local Group Policy also allows Group Policy Object management on standalone and non-domain computers.

In the beginning of Group Policy evolved out of what was called "System Policies." These were what we now call the Administrative Template extension or registry-based policy settings. These settings are considered to be "true" policy settings as opposed to what was then termed "preference" settings. What is the difference between GP policy settings and preferences?

GP policy settings will:

1. not tattoo. In other words, when a Group Policy object (GPO) goes out of scope, the policy setting is removed allowing the original configuration value to be used.
2. supersede an application's configuration setting. In other words, when a GP policy is configured to a value, the application is aware of that value and always uses it over the configurable value.
3. be recognized by an application. In other words, the display of the configuration item under control of a GP policy setting will be unavailable through the user interface. This is where graying out a configuration item on a menu, not displaying a dialog box, or providing a pop-up message explaining the current feature is under administrator control is used to inform the user they can't configure an option.

Preference settings will:

1. tattoo. In other words, when a GPO goes out of scope, the preference value will remain in the registry. An administrator is responsible for making sure these values are set to disable, prior to the GPO going out of scope, if the administrator wants the preference setting removed. The preference setting will not be replaced with the original application configuration value.
2. overwrite an application's configuration setting. This is accomplished by overwriting the original user configured-value for the application. No effort is made to retain the original value before overwriting the value with the preference setting. And, as was noted in 1, the overwritten value will not be removed when the GPO goes out of scope.
3. not be recognized by an application. In other words, the application's user interface will allow a user to change the configuration item. Most importantly, the Group Policy engine only recognizes when a GPO changes, not when the preference value has been changed. This means the preference setting will be applied once and not automatically reapplied if the user changes the value of the configuration item.

There was a desire to create a registry-based setting that was a melding of the GP policy settings with the preference settings which became the GP preferences. Unlike, preference settings, GP preference settings' behavior is configurable to act differently than a preference setting depending on the options you select.
GP preference settings will:

1. tattoo, by default. In other words, when a Group Policy object (GPO) goes out of scope, the GP preference setting will be remain in the registry.
   However, you can change the behavior of the GP preference setting by selecting the "Remove this item when it is no longer applied" option for a specific GP preference setting. After selecting this option, the GP preference setting will be removed when the GPO goes out of scope.
   
2. overwrite an application's configuration setting. This is accomplished by overwriting the original user configured-value for the application. The original value will not be retained when the application's configuration setting is overwritten by the GP preference setting.
   If the option to "Remove this item when it is no longer applied" has been selected, the GP preference setting will be removed. The application will use the default configuration value, not a previously set user configuration value.
   
3. not be recognized by an application. In other words, the application's user interface will allow a user to change the configuration item. By default, the GP preference setting will be automatically reapplied at every GP refresh, not when the application's configuration value has been changed by the user.
   Now the administrator can select the "Apply once and do not reapply" option. This will change the GP preference setting's behavior to only apply the GP preference setting value once and not apply again, even if the user has changed the application's configuration value.
   

When dealing with registry-based settings the differences between preference settings and GP preferences are subtle. The biggest difference I want to call out here is that while preference settings are always used in connection with registry-based settings, GP preferences can configure more than just registry-based settings. For more information check out the paper providing an overview of Group Policy preferences, http://go.microsoft.com/fwlink/?LinkId=103735.