Skip to main content

Applying Group Policy Objects to CIFS servers

Your CIFS server supports Group Policy Objects (GPOs), a set of rules known as group policy attributes that apply to computers in an Active Directory environment. You can use GPOs to centrally manage settings for all storage virtual machines (SVMs) on the cluster belonging to the same Active Directory domain.

When GPOs are enabled on your CIFS server, ONTAP sends LDAP queries to the Active Directory server requesting GPO information. If there are GPO definitions that are applicable to your CIFS server, the Active Directory server returns the following GPO information:

  • GPO name

  • Current GPO version

  • Location of the GPO definition

  • Lists of UUIDs (universally unique identifiers) for GPO policy sets

  • Supported GPOs
    Although not all Group Policy Objects (GPOs) are applicable to your CIFS-enabled storage virtual machines (SVMs), SVMs can recognize and process the relevant set of GPOs.
  • Requirements for using GPOs with your CIFS server
    To use Group Policy Objects (GPOs) with your CIFS server, your system must meet several requirements.
  • Enabling or disabling GPO support on a CIFS server
    You can enable or disable Group Policy Object (GPO) support on a CIFS server. If you enable GPO support on a CIFS server, the applicable GPOs that are defined on the group policy—the policy that is applied to the organizational unit (OU) that contains the CIFS server computer object—are applied to the CIFS server.
  • How GPOs are updated on the CIFS server
    By default, ONTAP retrieves and applies Group Policy Object (GPO) changes every 90 minutes. Security settings are refreshed every 16 hours. If you want to update GPOs to apply new GPO policy settings before ONTAP automatically updates them, you can trigger a manual update on a CIFS server with an ONTAP command.
  • Manually updating GPO settings on the CIFS server
    If you want to update Group Policy Object (GPO) settings on your CIFS server immediately, you can manually update the settings. You can update only changed settings or you can force an update for all settings, including the settings that were applied previously but have not changed.
  • Displaying information about GPO configurations
    You can display information about Group Policy Object (GPO) configurations that are defined in Active Directory and about GPO configurations applied to the CIFS server.
  • Displaying detailed information about restricted group GPOs
    You can display detailed information about restricted groups that are defined as Group Policy Objects (GPOs) in Active Directory and that are applied to the CIFS server.
  • Displaying information about central access policies
    You can display detailed information about the central access policies that are defined in Active Directory. You can also display information about the central access policies that are applied to the CIFS server through group policy objects (GPOs).
  • Displaying information about central access policy rules
    You can display detailed information about central access policy rules that are associated with central access policies defined in Active Directory. You can also display information about central access policies rules that are applied to the CIFS server through central access policy GPOs (group policy objects).