Interfaces and methods for group policy management

Abstract

A system and method for managing group policy objects in a network, including interfaces that allow access by programs or a user interface component to functions of a group policy management console that performs management tasks on group policy objects and other related objects. The interfaces abstract the underlying data storage and retrieval, thereby facilitating searching for objects, and providing the ability to delegate, view, change and permissions on those objects, and check and save those permissions. Modeling and other test simulations are facilitated by other interfaces. Other interfaces provide dynamic and interactive features, such as to convey progress and rich status messages, and allow canceling of an ongoing operation. Still other interfaces provide methods for operating on group policy related data, including group policy object backup, restore, import, copy and create methods, and methods for linking group policy objects to scope of management objects.

What is claimed is:  
     
         1 . In a computing environment, a system comprising: 
 a group policy management program; and    a set of at least one interface associated with the group policy management program, at least some of the interfaces providing access to functions that operate on group policy related data; and    a selected interface of the set called to perform a requested operation on group policy related data, and in response, the selected interface communicating with a directory service that is associated with the group policy related data to perform the requested operation.    
     
     
         2 . The system of  claim 1  wherein the management program comprises a management console having a user interface, and wherein the interfaces are incorporated into the management console.  
     
     
         3 . The system of  claim 1  wherein the group policy related data are associated with a domain, and wherein the controller comprises a domain controller.  
     
     
         4  The system of  claim 3  wherein the management program runs on the domain controller.  
     
     
         5 . The system of  claim 1  wherein the management console runs on a client computer.  
     
     
         6 . The system of  claim 1  wherein the group policy related data comprises a scope of management object.  
     
     
         7 . The system of  claim 1  wherein the group policy related data comprises a management instrumentation filter.  
     
     
         8 . The system of  claim 1  wherein the group policy related data comprises a group policy object.  
     
     
         9 . The system of  claim 8  wherein the group policy object comprises objects on a directory service and files on a system volume associated with the domain controller.  
     
     
         10 . The system of  claim 1  wherein the selected interface is called by a user interface.  
     
     
         11 . The system of  claim 10  wherein the management program includes the user interface.  
     
     
         12 . The system of  claim 1  wherein the selected interface is called by a program that requests the operation.  
     
     
         13 . The system of  claim 12  wherein the program that requests the operation comprises script.  
     
     
         14 . The system of  claim 1  wherein the selected interface comprises a group policy management interface that is invoked to access at least one other interface.  
     
     
         15 . The system of  claim 1  wherein the interfaces include a management interface having a function that is called to create an object corresponding to the group policy related data to perform the requested operation.  
     
     
         16 . The system of  claim 1  wherein the interfaces include a management interface having a function that is called to query for group policy related data to perform the requested operation.  
     
     
         17 . The system of  claim 16  wherein query for the group policy related data searches for group policy objects.  
     
     
         18 . The system of  claim 16  wherein the query for the group policy related data searches for a scope of management object corresponding to a domain.  
     
     
         19 . The system of  claim 16  wherein the query for the group policy related data searches for a scope of management object corresponding to a site.  
     
     
         20 . The system of  claim 16  wherein the query for the group policy related data searches for a scope of management object that links to a specified group policy object.  
     
     
         21 . The system of  claim 16  wherein the query for the group policy related data searches for group policy objects that are linked to a specified scope of management object.  
     
     
         22 . The system of  claim 16  wherein the query for the group policy related data searches for management instrumentation filters.  
     
     
         23 . The system of  claim 16  wherein the query for the group policy related data searches for backups of group policy objects.  
     
     
         24 . The system of  claim 1  wherein the selected interface comprises a domain interface that is called to manage group policy for a domain.  
     
     
         25 . The system of  claim 24  wherein the domain interface provides access to a function that creates a group policy object in the domain.  
     
     
         26 . The system of  claim 24  wherein the domain interface provides access to a function that restores a group policy object to the domain.  
     
     
         27 . The system of  claim 24  wherein the domain interface provides access to a function that retrieves an interface for a group policy object in the domain.  
     
     
         28 . The system of  claim 1  wherein the selected interface invokes a domain interface to manage group policy for a domain.  
     
     
         29 . The system of  claim 24  wherein the domain interface provides access to a function that queries for a scope of management object in the domain.  
     
     
         30 . The system of  claim 24  wherein the domain interface provides access to a function that queries for a management instrumentation filter.  
     
     
         31 . The system of  claim 1  wherein the selected interface comprises a search criteria interface that is called to define criteria for search operations.  
     
     
         32 . The system of  claim 1  wherein the selected interface comprises a backup interface that is called to retrieve at least one property of a backup object.  
     
     
         33 . The system of  claim 1  wherein the selected interface comprises a backup interface that is called to delete a backup object.  
     
     
         34 . The system of  claim 1  wherein the selected interface comprises a backup interface that is called to generate a report of the contents of a backup.  
     
     
         35 . The system of  claim 1  wherein the selected interface comprises a backup collection interface that is called to access a collection of group policy object backups.  
     
     
         36 . The system of  claim 1  wherein the selected interface comprises a backup directory interface that is called to query group policy object backups.  
     
     
         37 . The system of  claim 1  wherein the selected interface comprises a client side extension interface that is called to query client-side extension properties.  
     
     
         38 . The system of  claim 24  wherein the domain interface provides access to a function that queries for a group policy object.  
     
     
         39 . The system of  claim 1  wherein the selected interface comprises a constants interface that is called to retrieve the value of at least one constant used by the group policy management console.  
     
     
         40 . The system of  claim 1  wherein the selected interface comprises a client-side extension collection interface that is called to access a collection of client-side extension objects.  
     
     
         41 . The system of  claim 1  wherein the selected interface comprises a group policy object interface that is invoked to manage a group policy object.  
     
     
         42 . The system of  claim 41  wherein the group policy object interface is called to delete the group policy object.  
     
     
         43 . The system of  claim 41  wherein the group policy object interface is called to import settings from the group policy object.  
     
     
         44 . The system of  claim 41  wherein the group policy object interface is called to back up settings from the group policy object.  
     
     
         45 . The system of  claim 41  wherein the group policy object interface is called to copy settings from the group policy object to another group policy object.  
     
     
         46 . The system of  claim 41  wherein the group policy object interface is called to set security information on the group policy object.  
     
     
         47 . The system of  claim 41  wherein the group policy object interface is called to retrieve security information from the group policy object.  
     
     
         48 . The system of  claim 41  wherein the group policy object interface is called to generate a report on the group policy object.  
     
     
         49 . The system of  claim 41  wherein the group policy object interface is called to retrieve a management instrumentation filter linked to the group policy object.  
     
     
         50 . The system of  claim 41  wherein the group policy object interface is called to link a management instrumentation filter on the group policy object.  
     
     
         51 . The system of  claim 41  wherein the group policy object comprises data maintained in a directory service and a system volume folder, and wherein the group policy object interface is called to check for the consistency of access control data between the directory service and the system volume folder.  
     
     
         52 . The system of  claim 41  wherein the group policy object comprises data maintained in a directory service and a system volume folder, and wherein the group policy object interface is called to make access control data consistent between the directory Service and the system volume folder.  
     
     
         53 . The system of  claim 41  wherein the group policy object interface is called to determine whether user policy settings in the group policy object are enabled.  
     
     
         54 . The system of  claim 41  wherein the group policy object interface is called to enable or disable user policy settings in the group policy object.  
     
     
         55 . The system of  claim 41  wherein the group policy object interface is called to determine whether computer policy settings in the group policy object are enabled.  
     
     
         56 . The system of  claim 41  wherein the group policy object interface is called to enable or disable computer policy settings in the group policy object.  
     
     
         57 . The system of  claim 1  wherein the selected interface comprises a collection interface that is called to access a collection of group policy objects.  
     
     
         58 . The system of  claim 1  wherein the selected interface comprises a group policy object link interface that is called to manage a group policy object link for a given scope of management object.  
     
     
         59 . The system of  claim 1  wherein the selected interface comprises a trustee interface that is called to retrieve information about a specified trustee.  
     
     
         60 . The system of  claim 1  wherein the selected interface comprises a permission interface.  
     
     
         61 . The system of  claim 1  wherein the selected interface comprises a security information interface.  
     
     
         62 . The system of  claim 61  wherein the security information interface is called to retrieve permission-related properties that exist on a particular scope of management object.  
     
     
         63 . The system of  claim 61  wherein the security information interface is called to determine permission-related properties that exist on a particular scope of management object.  
     
     
         64 . The system of  claim 61  wherein the security information interface is called to add permission-related properties with respect to a particular scope of management object.  
     
     
         65 . The system of  claim 61  wherein the security information interface is called to remove permission-related properties that exist on a particular scope of management object.  
     
     
         66 . The system of  claim 61  wherein the permission interface is called to retrieve permission-related properties.  
     
     
         67 . The system of  claim 61  wherein the permission interface is called to determine permission-related properties.  
     
     
         68 . The system of  claim 61  wherein the permission interface is called to add permission-related properties.  
     
     
         69 . The system of  claim 61  wherein the permission interface is called to remove permission-related properties.  
     
     
         70 . The system of  claim 61  wherein the security information interface is called to add a permission to a particular group policy object.  
     
     
         71 . The system of  claim 61  wherein the security information interface is called to add a permission to a particular management instrumentation filter.  
     
     
         72 . The system of  claim 61  wherein the security information interface is called to remove a permission from a particular scope of management object.  
     
     
         73 . The system of  claim 61  wherein the security information interface is called to remove a permission from a particular group policy object.  
     
     
         74 . The system of  claim 61  wherein the security information interface is called to remove a permission from a particular management instrumentation filter.  
     
     
         75 . The system of  claim 1  wherein the selected interface comprises a resultant set of policy interface that is called to query resultant set of policy.  
     
     
         76 . The system of  claim 1  wherein the selected interface comprises a sites container interface that is called to query the scope of management objects for particular sites in a forest.  
     
     
         77 . The system of  claim 1  wherein the interfaces include a scope of management interface that is called to manage a scope of management object.  
     
     
         78 . The system of  claim 77  wherein the scope of management interface is called to create group policy object links for the scope of management object.  
     
     
         79 . The system of  claim 77  wherein the scope of management interface is called to retrieve group policy object links for the scope of management object.  
     
     
         80 . The system of  claim 77  wherein the scope of management interface is called to retrieve security attributes of the scope of management object.  
     
     
         81 . The system of  claim 77  wherein the scope of management interface is called to set security attributes of the scope of management object.  
     
     
         82 . The system of  claim 77  wherein the scope of management interface is called to retrieve at least one property of the scope of management object.  
     
     
         83 . The system of  claim 77  wherein the scope of management interface is called to set at least one property of the scope of management object.  
     
     
         84 . The system of  claim 1  wherein the interfaces include a scope of management collection interface that is called to access a collection of scope of management objects.  
     
     
         85 . The system of  claim 1  wherein the interfaces include a group policy object links collection interface that is called to access a collection of group policy object links.  
     
     
         86 . The system of  claim 1  wherein the interfaces include a cancel interface that is called to cancel the requested operation.  
     
     
         87 . The system of  claim 1  wherein the interfaces include a progress interface that is called to provide client notification data about the progress of the operation.  
     
     
         88 . The system of  claim 1  wherein the interfaces include a status message interface that is called to retrieve at least one property of status messages that are related to group policy object operations.  
     
     
         89 . The system of  claim 1  wherein the interfaces include a status message collection interface that is invoked to access a collection of status messages.  
     
     
         90 . The system of  claim 1  wherein the selected interface comprises a result interface that is called to retrieve status message information while performing the operation.  
     
     
         91 . The system of  claim 1  wherein the selected interface comprises a management instrumentation filter interface that is called to manage data of a management instrumentation filter.  
     
     
         92 . The system of  claim 91  wherein the management instrumentation filter interface is called to retrieve at least one property for a management instrumentation filter.  
     
     
         93 . The system of  claim 91  wherein the management instrumentation filter interface is called to set at least one property for a management instrumentation filter.  
     
     
         94 . The system of  claim 91  wherein the management instrumentation filter interface is called to retrieve security attributes for a management instrumentation filter.  
     
     
         95 . The system of  claim 91  wherein the management instrumentation filter interface is called to set security attributes for a management instrumentation filter.  
     
     
         96 . The system of  claim 1  wherein the selected interface comprises a management instrumentation filter collection interface that is called to access a collection of management instrumentation filters.  
     
     
         96 . The system of  claim 1  wherein the interfaces include a migration interface that is called to access migration information  
     
     
         96 . The system of  claim 1  wherein the interfaces include a map entry interface that is called to retrieve map entries.  
     
     
         97 . The system of  claim 1  wherein the interfaces include a map entry collection interface that is called to access a collection of map entries.  
     
     
         98 . A computer-readable medium having computer-executable components for implementing the system of  claim 1 .  
     
     
         99 . In a computing environment, a method comprising: 
 providing a plurality of interfaces including interfaces that when called perform operations on group policy related data;    receiving a call on one of the interfaces, the call requesting a task related to management of at least one group policy object; and    communicating with at least one entity that contains data corresponding to the group policy related data to satisfy the requested management task.    
     
     
         100 . The method of  claim 99  wherein the group policy related data comprises a group policy object.  
     
     
         101 . The method of  claim 99  wherein the group policy related data comprises a scope of management object.  
     
     
         102 . The method of  claim 1  wherein the group policy related data comprises a management instrumentation filter.  
     
     
         103 . The method of  claim 99  wherein communicating with at least one entity comprises communicating with a directory service.  
     
     
         104 . The method of  claim 99  wherein communicating with at least one entity comprises communicating with a domain controller.  
     
     
         105 . The method of  claim 99  further comprising, accessing files on a system volume of the domain controller to satisfy the requested management task.  
     
     
         106 . The method of  claim 99  further comprising, accessing at least one object of the directory service to satisfy the requested management task.  
     
     
         107 . The method of  claim 99  further comprising querying for group policy objects to satisfy the requested management task.  
     
     
         108 . The method of  claim 99  further comprising querying for scope of management objects to satisfy the requested management task.  
     
     
         109 . The method of  claim 99  further comprising querying for management instrumentation filters to satisfy the requested management task.  
     
     
         110 . The method of  claim 99  further comprising querying a file system to satisfy the requested management task.  
     
     
         111 . The method of  claim 99  further comprising querying a directory service to satisfy the requested management task.  
     
     
         112 . The method of  claim 99  further comprising, receiving search criteria, and searching based on the search criteria to satisfy the requested management task.  
     
     
         113 . The method of  claim 99  further comprising, restoring a group policy object to satisfy the requested management task.  
     
     
         114 . The method of  claim 99  further comprising, backing up a group policy object to satisfy the requested management task.  
     
     
         115 . The method of  claim 99  further comprising, importing settings to a group policy object to satisfy the requested management task.  
     
     
         116 . The method of  claim 99  further comprising, copying settings from one group policy object to another group policy object to satisfy the requested management task.  
     
     
         117 . The method of  claim 116  further comprising, creating the other group policy object.  
     
     
         118 . The method of  claim 99  further comprising accessing a collection of group policy object backups to satisfy the requested management task.  
     
     
         119 . The method of  claim 99  further comprising querying client-side extension properties to satisfy the requested management task.  
     
     
         120 . The method of  claim 99  further comprising retrieving a value of at least one group policy management console constant to satisfy the requested management task.  
     
     
         121 . The method of  claim 99  further comprising accessing a collection of client-side extension objects to satisfy the requested management task.  
     
     
         122 . The method of  claim 99  further comprising deleting an individual group policy object to satisfy the requested management task.  
     
     
         123 . The method of  claim 99  further comprising generating a report on an individual group policy object to satisfy the requested management task.  
     
     
         124 . The method of  claim 99  further comprising setting security information to satisfy the requested management task.  
     
     
         125 . The method of  claim 99  further comprising retrieving security information to satisfy the requested management task.  
     
     
         126 . The method of  claim 99  further comprising checking for the consistency of access control data between the directory service and the system volume folder to satisfy the requested management task.  
     
     
         127 . The method of  claim 99  further comprising making access control data consistent between the directory service and the system volume folder to satisfy the requested management task.  
     
     
         128 . The method of  claim 99  further comprising accessing a collection of group policy objects to satisfy the requested management task.  
     
     
         129 . The method of  claim 99  further comprising retrieving status message information while performing an operation to satisfy the requested management task.  
     
     
         130 . The method of  claim 99  further comprising retrieving information about a specified trustee to satisfy the requested management task.  
     
     
         131 . The method of  claim 99  further retrieving permission-related properties to satisfy the requested management task.  
     
     
         132 . The method of  claim 99  further comprising establishing a set of permissions to satisfy the requested management task.  
     
     
         133 . The method of  claim 99  further comprising adding a permission to satisfy the requested management task.  
     
     
         134 . The method of  claim 99  further comprising removing a permission to satisfy the requested management task.  
     
     
         135 . The method of  claim 99  further comprising querying resultant set of policy to satisfy the requested management task.  
     
     
         136 . The method of  claim 99  further comprising creating at least one group policy object link for a scope of management object to satisfy the requested management task.  
     
     
         137 . The method of  claim 99  further comprising setting security attributes for a scope of management object to satisfy the requested management task.  
     
     
         138 . The method of  claim 99  further comprising retrieving security attributes for a scope of management object to satisfy the requested management task.  
     
     
         139 . The method of  claim 99  further comprising retrieving properties for a scope of management object to satisfy the requested management task.  
     
     
         140 . The method of  claim 99  further comprising canceling an operation to satisfy the requested management task.  
     
     
         141 . The method of  claim 99  further comprising returning progress data to satisfy the requested management task.  
     
     
         142 . The method of  claim 99  further comprising returning a status message to satisfy the requested management task.  
     
     
         143 . The method of  claim 99  further comprising accessing a collection of status messages to satisfy the requested management task.  
     
     
         144 . The method of  claim 99  further comprising setting security attributes for a management instrumentation filter to satisfy the requested management task.  
     
     
         145 . The method of  claim 99  further comprising accessing a migration data to satisfy the requested management task.  
     
     
         146 . A computer-readable medium having computer-executable instructions for performing the method of  claim 99 .  
     
     
         147 . In a computing environment, a method comprising: 
 receiving a request to manage security settings of a group policy data construct;    generating a permissions table based on security information associated with the group policy object;    and accessing the permissions table to satisfy the request.    
     
     
         148 . The method of  claim 147  wherein the group policy data construct comprises a group policy object.  
     
     
         149 . The method of  claim 147  wherein the group policy data construct comprises a scope of management object.  
     
     
         150 . The method of  claim 147  wherein the group policy data construct comprises a WMI filter.  
     
     
         151 . The method of  claim 147  wherein accessing the permissions table includes adding a permission.  
     
     
         152 . The method of  claim 147  wherein accessing the permissions table includes removing a permission.  
     
     
         153 . The method of  claim 147  further comprising, saving security settings to an object based on the permissions table.  
     
     
         154 . A computer-readable medium having computer-executable instructions for performing the method of  claim 147 .  
     
     
         155 . The system of  claim 16  wherein the query for the group policy related data searches for a scope of management object corresponding to a site.  
     
     
         156 . The system of  claim 77  wherein the scope of management interface is called to retrieve inherited group policy object links for the scope of management object.