Using GPO Accelerator

Although many desktop administrators create their baseline configurations from scratch by creating new, empty GPOs, you can choose from other alternatives. The GPO Accelerator is a command-line tool provided by Microsoft that enables administrators to implement the EC or SSLF workstation environment automatically on an AD DS network.

The GPO Accelerator is a free download, included as part of the Security Compliance Management Toolkit. When you execute the GPOAccelerator.msi file on a Windows server or workstation, the installer adds a script file called GPOAccelerator.wsf and an executable called GPOAccelerator.exe.

In this case, the script file does all the work. The executable is just a wizard that enables you to select program features using a graphical interface, as shown in Figure 4-30. After you make your selections, the wizard executes the script from the command line, inserting the appropriate parameters.

When you run GPOAccelerator, the tool first creates the appropriate GPOs, as shown in Figure 4-31, and populates them with a standardized group of configuration settings for the environment you have chosen.

Then the GPO Accelerator can create a hierarchy of OUs in your domain, as shown in Figure 4-32, and link the GPOs to the proper OUs.

The GPOs that the GPOAccelerator tool creates contain a large variety of settings, including the following:

These and many other settings implement the EC and SSLF environments described in the “Windows 7 Security Guide.” Although Microsoft has tested these environments in typical settings, you must test them thoroughly yourself on your own network before you implement them on a production network.