Windows Media Player with Group Policy video transcript

Hi, this is Jeremy Moskowitz, Microsoft MVP, Enterprise Mobility and Founder of PolicyPak Software.In this video we’re going to learn how to lock down Windows Media Player 11 and 12.

If we take a look at Windows Media Player on our example client machine here, let’s take a look. Yeah, we’ve got to go through this “Recommended settings” stuff or set up custom settings. That’s no fun here, but it only takes a second for every user to have to do that. Then they can go to “Tools/Options.” There are a couple ways to do that.

You can see that there are a lot of scary settings for a user and for you actually. The idea is that if you want to prevent users from burning or ripping music, really there’s no way to do that but still allow them to use Windows Media Player. Well, with PolicyPak that’s exactly what we’re going to do.

Let’s figure out how to deploy some settings that are important to us and gray out some other settings that are definitely harmful for the user. Lots of scary settings here. Let’s close that out for now.

What we’ll do is we will start off by going over to our Management Station. We’ll go to “C:Program FilesPolicyPakExtensions.” You’ve probably seen me do this in other videos by now. I’ll click on the “PreConfigured PolicyPaks” folder that you’ll download from PolicyPak.

We’ll click on “Windows Media Player 11,” and this actuallyis good for 11 and 12. We’ll copy in the precompiled PolicyPak “pp-WindowsMediaPlayer.dll.” We’ll just “Copy here” right to our PolicyPak Extensions folder as, like I said, you’ve seen me do in other videos.

Now that that’s locked and loaded for our “East Sales Users” we’re going to “Create a GPO” and “Lock down Windows Media Player on Windows 7.” That GPO is linked to our “East Sales Users.” We’ll go ahead and “Edit…” it. We’ll dive down under user side “PolicyPak/Applications/New/Application.” You can see we’ve got lots of applications here. The one, of course, that we’re interested in right now is “PolicyPak for Windows Media Player.”

Let’s go ahead and take a look at some things. The first thing that’s kind of scary is “Burn.” We want to make sure that users don’t really have access to this “Burn” ability here. What we can do is we can right click over the “Burn” tab and “Disable whole tab in target application.”Let’s just get rid of that whole thing right there.

Let’s go over to “Rip Music” here as well.We want to make sure that if a user does do something they shouldn’t do, ripping music probably not such a good idea either. We could set these configurations settings, but let’s go ahead and just right click and “Disable whole tab in target application” for “Rip Music” as well.

Let’s head on over to “Security.” There’s a lot of security stuff here, but users don’t really understand security like you do. So if this is important for you, and by the way, I think this default here of “Run script commands and rich media streams when the player is in” the webpage is what it should be saying here. I don’t know about you, but that sounds kind of scary to me. I want to leave that unchecked.

If we take a look at the client machine, right now let’s go back to our machine just to show you here. If I go to “Security,” you can see that’s set by default. Why don’t we go ahead and if the user does something they shouldn’t do like check all four of these checkboxes which is kind of scary, what we can do is we can guarantee to undeliver those checkboxes.

They’re now set; let’s go ahead and undeliver them. We’re setting all those checkboxes to uncheck. While we’re here also, let’s go ahead and we’ll “Disable corresponding control in target application” this one, we’ll “Disable corresponding control in target application” this one and, why not? Let’s go crazy. We’ll “Hide corresponding control in target application”this one and also “Hide corresponding control in target application” this one. We’re literally changing the UI for the user.

That’s it.Let’s go over to the user. We’ll get type “cmd” and get a command prompt here. We’ll run “gpupdate.” We’re downloading the latest Group Policy settings for the user. You could also pretend that the user is logging on for the first time or that they’re changing job roles or getting a new machine. Whenever any of those things happen, that is when PolicyPak kicks into gear. Because we are Group Policy, we just apply at the same time regular Group Policy does.

Let’s go ahead and rerun “Windows Media Player” here, and let’s see what we can find. Again, we’re just a regular user here. Go to “Tools/Options.” Look at that. “Rip Music” is now grayed out. “Burn” is grayed out. Let’s go over to our “Security.” We can see that we’ve unchecked all those checkboxes and literally removed the UI from some of those other scary settings that we don’t want users to have access to.We’re configuring the settings, locking out the things we don’t want users to get to and therefore making our world more secure.

That completes this tutorial for how to use PolicyPak with regards to Windows Media Player 11 and 12. I hope you found that useful. When you’re ready to try PolicyPak out, we’re here for you.

Thanks so much. We’ll talk to you soon.