Using group policies to configure settings

Many configuration parameter values can be controlled by enabling and applying corresponding Centrify group policies through the Group Policy Management Editor. When you use group policies to set configuration parameters, the group policy setting overrides any local configuration setting and the group policy setting is reapplied if the computer is rebooted and periodically when the group policy is automatically refreshed. Therefore, if a group policy exists for configuring a specific setting, in most cases, you should use the group policy rather than edit the local configuration file.

If no group policy exists for a configuration parameter you want to change or if no group policy is applied to the local computer, you can customize the local configuration file to set configuration parameter values as needed.

To determine whether a group policy exists to configure a specific setting, and which group policies affect which settings, see the Group Policy Guide (centrify-grouppolicy-guide.pdf). When you open the Group Policy Guide PDF file, use the PDF reader search function to search for a setting (for example, adclient.cache.expires.gc). If the setting can be configured with a group policy, the setting is referred to in the group policy description.

Note:   It is possible for an Active Directory administrator to override virtually any setting in the local configuration file using group policies applied to a local computer. This effectively gives administrators with permission to enable or disable group policies root-level access to computers in the zones they manage. There is no way to effectively prevent settings from being changed, except by disabling user, computer, or all group policies in the local centrifydc.conf or centrifyda.conf file or by strictly controlling who has permission to enable and apply group policies to computers that join an Active Directory domain.

For information about disabling the application of group policies using settings in the local centrifydc.conf file, see Customizing group policy configuration parameters For more information about enabling and applying group policies rather than setting configuration parameters locally on a computer, see the Group Policy Guide.