Third-party Tools and Extensions for Group Policy
Group Policy allows administrators to efficiently implement security settings, enforce IT policies, and distribute software consistently across a given site, domain, or range of organizational units. The third-party tools and extensions listed in the table below extend Group Policy functionality and manageability even further. (Note that following the links will take you to Web sites outside of Microsoft.com.)
Note Microsoft neither endorses nor provides support for these third-party products. Please contact the specific software provider for support issues.
| Product | Description | Company | ||||||||||||||||||||||||||||
The Centrify DirectControl suite seamlessly integrates your UNIX, Linux, and Macintosh systems with Microsoft Active Directory's Group Policy services. Through Group Policy, you can enforce consistent security and configuration policies across these heterogeneous systems using the same familiar tools and processes you use to manage your Windows systems. DirectControl provides a wide range of group policies designed specifically for individual platforms that enable you to apply consistent updates to the sudoers file and maintain consistent automount settings for groups of users or systems. With DirectControl's innovative Zone technology you can create management groups for granular control over related sets of systems. These Group Policy features are integrated into the core DirectControl product, which also extends Active Directory's authentication and access control services to these non-Microsoft platforms. | Centrify | |||||||||||||||||||||||||||||
DesktopStandard's PolicyMaker Share Manager is a Group Policy extension that provides the ability to centrally manage network shares both on servers and workstations. It enables you to leverage Windows Server 2003's built-in Access-Based Enumeration (ABE) for shared folders, empowering you to restrict the visibility of shared resources to those who end-users who have read permission. You can also remove and prohibit all unauthorized shares on the network as a matter of policy. | DesktopStandard | |||||||||||||||||||||||||||||
In 2007, GPOVault Enterprise from DesktopStandard will be transformed into Microsoft Advanced Group Policy Management (AGPM), part of the Microsoft Desktop Optimization Pack for Software Assurance. AGPM integrates enhanced Group Policy management features into the Microsoft Group Policy Management Console (GPMC), adding comprehensive change control, offline editing, role-based delegation, difference reporting, and GPO templates. | DesktopStandard | |||||||||||||||||||||||||||||
BeyondTrust Privilege Manager, from BeyondTrust Corporation, is a Group Policy extension that provides a least-privilege security model for Windows. Organizations can now give restricted users elevated permissions for selected tasks and applications. At the same time they can reduce permissions of applications such as Internet Explorer and Microsoft Outlook when launched by administrators. | BeyondTrust | |||||||||||||||||||||||||||||
DesktopStandard's PolicyMaker Registry Extension adds full registry management capabilities. The administrator can simply launch the Registry Wizard and select one or more existing settings of any type from the local computer or another computer on the network. Tattooing is eliminated by using the standard PolicyMaker option to automatically remove a setting if it is no longer being applied, and each setting may be independently targeted using the graphical filtering system. | DesktopStandard | |||||||||||||||||||||||||||||
DesktopStandard's PolicyMaker Standard Edition is a suite of 21 Group Policy extensions for desktop standardization—security and compliance management—complimenting the native extensions provided with Microsoft Windows. Using PolicyMaker, organizations can eliminate scripts, reduce system imaging, standardize management, and better secure their networks. | DesktopStandard | |||||||||||||||||||||||||||||
GPAnywhere, from Full Armor, makes Group Policy "portable" to reach beyond Microsoft Active Directory directory services to remote VPN, mobile, kiosk, point-of-sale, and other disconnected computers. | Full Armor | |||||||||||||||||||||||||||||
Full Armor's IntelliPolicy for Clients provides an array of settings to enhance the management of the Windows desktop. It eliminates the use of scripts and manual configuration, and gives administrators the ability to centrally manage desktops. Using IntelliPolicy for Clients, administrators can:
| Full Armor | |||||||||||||||||||||||||||||
NetIQ's Group Policy Administrator assists in planning, managing, troubleshooting, and reporting on Group Policies. Group Policy Administrator offers:
| NetIQ | |||||||||||||||||||||||||||||
NetIQ's Group Policy Guardian helps reduce risks associated with Group Policy Object (GPO) change management and provides the visibility you need to help protect your Windows infrastructure from security exposures and service disruptions. Features include:
| NetIQ | |||||||||||||||||||||||||||||
GPOADmin provides extended GPO management capabilities from within GPMC. The product requires no script-writing or manual processes, saving time and reducing the risk of outages. The design provides easy access to the details and information required for the largest Active Directory deployments. GPOADmin extends the capabilities of GPMC and GPO Editor by simplifying the use and administration of such critical tasks as GPO version control, auditing and comparison. GPOADmin enables verification of changes made to a GPO over time or the consistency of GPO settings between different GPOs (such as test and production GPOs).
| NetPro | |||||||||||||||||||||||||||||
PolicyPak is a collection of tools which enables you to control your existing desktop and server application settings directly with Group Policy. Deploy and manage all settings for supported applications as if they were natively Group-Policy enabled. Each PolicyPak looks and acts just like the application you want to manage. Adobe Reader, Adobe Acrobat 7.0, and Microsoft Exchange Server 2003 are examples of supported applications. | PolicyPak Software | |||||||||||||||||||||||||||||
Quest's Group Policy Manager uses GPMC as its foundation technology, to give you GPO editing, import and export, reporting, and resultant set of policy (RSoP) functionality. Group Policy Manager also provides version control, enhanced RSoP reporting, rapid rollback, and reporting. | Quest Software | |||||||||||||||||||||||||||||
GPExpert Backup Manager for Group Policy provides a complete solution for managing Group Policy backups, rollback, and recovery. It provides at-a-glance management of Group Policy backups from a central console; lets you back up and roll back changes to GPOs and GPO Links; lets you schedule automated backups, log backup, and recovery events to the event log; and provides a quick check feature to ensure that live GPOs always have a current backup. It also provides a “Backup-on-Edit” feature that triggers an automatic backup of a GPO when you go to edit it. A free, fully functional trial version is available for evaluation. | SDM Software | |||||||||||||||||||||||||||||
The GPExpert Troubleshooting Pak provides a set of tools for ensuring that Group Policy is functioning efficiently in your environment. In addition, if there are problems, the Troubleshooting Pak lets you explore problem areas and provides expert help for a speedier resolution. The Troubleshooting Pak includes:
| SDM Software | |||||||||||||||||||||||||||||
The GPExpert Scripting Toolkit for PowerShell allows you to automate the management of Group Policy settings. The Scripting Toolkit exposes the actual settings within Active Directory-based Group Policy objects (GPOs) and local GPOs via PowerShell, .NET, or VBScript, so you can fully automate the reading, writing, and deletion of the settings within a GPO. | SDM Software | |||||||||||||||||||||||||||||
Specops Command combines Group Policy and PowerShell, thus enabling system administrators to distribute and execute PowerShell and PowerShell scripts and cmdlets on remote machines using Group Policy. Specops Command includes:
| Special Operation Software | |||||||||||||||||||||||||||||
Specops Deploy, from Special Operations Software, is a Group Policy client-side extension (CSE) that replaces the built-in Group Policy software installation (GPSI) functionality in Microsoft Windows. With Group Policy, Specops Deploy adds the following functionality:
| Special Operations Software | |||||||||||||||||||||||||||||
Specops Gpupdate provides commonly needed operations such as refresh of Group Policy Objects (gpupdate), restarts, wake-on-lan and shutdowns of computers directly from within the native Active Directory Users and Computers user interface. Perform the following operations remotely with Specops Gpupdate:
| Special Operations Software | |||||||||||||||||||||||||||||
Inventory Asset management and Software License Compliance Management:
| Special Operations Software | |||||||||||||||||||||||||||||
Specops Password Policy – Multiple password policies in a single Active Directory domain. Specops Password Policy greatly enhances security in Active Directory domains by adding the possibility to have an unlimited number of different password policies in a single domain, removing the current obstacle of having to rely on a single password policy. This creates an environment that does not rely on a single rule that has to be weak enough to work for all users. Relying on the Group Policy model it is possible to have a separate password policy for any OU, security group or even single user. Specops Password Policy also adds a large number of advanced new security settings for creating password policies, to strengthen the passwords in the domain even further. The Specops Password Policy Sentinel is implemented as a password filter and need only to be installed on the domain controllers to work. In addition there is an optional client included that can be installed on member servers and desktops that informs the users about the password policy they are currently affected by when selecting new passwords. Additional features:
| Special Operations Software | |||||||||||||||||||||||||||||
SysPro's ADM Template Editor uses wizards to simplify the ADM template editing process. Features include:
| SysPro | |||||||||||||||||||||||||||||
PolMan, from SysPro, reports on, tracks changes to, and checks integrity of policies, and monitors implementation on workstations. Specific functionality includes:
| SysPro |
