In this post we are going to begin to touch Group Policy Objects (GPO) and begin to apply them to our domain structure. We will be making one GPO in this article and it’ll be the start of a standard for all systems on the domain regardless of operating system (OS) and role. This policy will allow us to ensure a configuration across the enterprise in one fell swoop.
This policy can be thought of as a living document because as you build you might have certain preferences you want applied across the board. It is important to note that this policy isn’t intended to circumvent Security Technical Implementation Guides (STIG) and should only be utilized to configure settings that do not affect the security of your devices.
We’ll start by creating the GPO called Enterprise – Domain Baseline.
Once you’ve created the GPO you will want to right-click the GPO and click Edit. This will open the GPO in a new window for you to modify.
There is no time setting we can just set within the GPO. To set the timezone correctly we’ll have to create a registry key. To do this expand the Computer Configuration, Preferences and then Windows Settings. Once here right-click on Registry, select New and then Registry Wizard.
There will be a popup that will ask you where you’d like to extract this setting from. In this example I’m going to just use Local Computer because I have already changed the timezone on system I’m using to create this GPO.
The key we want to pull is HKLM\SYSTEM\CurrentControlSet\Control\TimeZoneInformation. In the window you’ll navigate down to that key and once there ensure all data is checked. Click Finish when you are done.
You’ll now have that window close and you’ll be back looking at your GPO. Highlight Registry and you will be able to see the new key. In the example below I’ve renamed that entry Timezone Configuration to be able to distinguish it later if needed.
The next step will be to apply this GPO to where it’ll apply to everything. However, I do not recommend linking anything at the root of your AD structure. In this case I will apply it to the Domain Controllers and Enterprise Organizational Units (OU).
Now that you have the GPO configured and applied the easiest thing to do is reboot the system(s) and verify that the GPO did exactly what you needed it to do.