So today we're going to take a look at the approval process within GPOADmin. The idea is that a user will check out a Group Policy, make modifications, check the Group Policy back in, and then somebody else will need to approve the changes before the GPO can be deployed. So let's get started.
First we need to make sure our SMTP settings are configured properly. You can see here on the SMTP tab we have Enable SMTP Notification, put in your SMTP Server Address, Port, and the From Address. You can also select these options, the Enable Workflow Approval Through Email, so you don't need to go to the GPOADmin console. Instead, you can approve changes via email. And we'll take a look at that, too.
So the next thing we need to do is at the Version Control Root. We would right click, select Properties, we'd go to the Approvals. Here I can then define the groups or users that will approve a request. This is for modification, but I can also define different groups or users to approve creates and deletes. Because this is a group and multiple people can be in a single group, we can tell GPOADmin that I need at least two people to approve this request before it can be deployed.
Then at the Version Control Containers I have this container USA Enterprise Users. We can right mouse click, select Properties, and you can see that under the Approvals we have the option to either override the inherited workflow, so overriding the settings at the Version Control Root, which I did, and I've decided that for this particular USA Enterprise Users Container I want Acme Administrator to be the approver.
So now let's log in as US GPOADmin. US GPOADmin has the rights to modify GPOs in the US Enterprise Users Container. First thing we'll do is we will right mouse click on the GPO and we'll check out the GPO. We can put in a comment, so I'm going to make some new IE settings. Now we can see the GPO is checked out so at this point we want to make some changes with the Launch the Editor. Let's go ahead and make some user changes. And the change we'll make today is we want to not allow users to disable add-ons.
Now US GPOADmin needs to check in the GPO. Notice the version number has now increased by point 1. We will then request approval and as you can see under the status, this GPO is pending approval by ACME Administrator. In order to approve the GPO, we need to log in as ACME Administrator. ACME Administrator sees that the GPO is pending approval. But if we check his email we will see an email asking for approval, approval request notification. There are also two attached files so we can take a look at the Settings for the GPO, or just the Difference Report.
So let's open the Difference Report. Well, we can scroll down and we can see some items have not changed. And then we can also see that some items have changed as you can see by the green Added status here. And it shows which setting was enabled. So here it's not enabled in the live version, but in version 8.1 it is enabled. And this is the setting Do Not Allow Users to Enable or Disable Add-ons. OK, everything looks good.
So at this point let's go ahead and approve this GPO. The GPO has been approved and we can see the status is now Pending Deployment. We will now log in as US GPOADmin. US GPOADmin sees that the US GPO IE settings GPO is Pending Deployment, so now we can right mouse click, select Deploy. We can add a comment if needed. We can also deploy the GPO immediately or we can schedule the deployment for a future time. So the GPO is now deployed and available for users. Notice that the version is now 9.0. And that was a demo of the approval workflow process in GPOADmin.
06:23
