Machine policy configuration for managed devices
Disclosed are various examples for managing and customizing policy configurations on user devices enrolled in an enterprise management service. The policy configurations can include machine policies and/or user policies. An administrator can customize a baseline including a list of policies supported by an operating system of managed user devices. A management component on the user devices can obtain the baseline specified by the administrator from a managing service and apply the policies to the user device.
1. A system for machine policy enforcement, the system comprising:
a client device enrolled in a management service; and
at least one application executable in the client device, wherein the at least one application, when executed, causes the client device to:
obtain a baseline configuration file from a computing device associated with the management service, the baseline configuration file comprising a list of policies associated with an operating system of the client device, and the baseline configuration file being obtained from a command queue of the computing device; and
apply the list of policies for the client device by modifying a registry of the operating system in accordance with the list of policies.
2. The system of claim 1 , wherein a particular policy in the list of policies is a non-registry policy, and applying the particular policy further comprises generating a command-line input to apply the particular policy using a command line interface of the operating system.
3. The system of claim 1 , wherein the baseline configuration file comprises an extensible markup language (XML) document.
4. The system of claim 1 , wherein the at least one application further causes the client device to at least detect a change to the registry that differs from a policy included in the list of policies.
5. The system of claim 4 , wherein the at least one application further causes the client device to at least reapply the baseline configuration file in an instance in which the change is detected.
6. The system of claim 1 , wherein the list of policies include Group Policy settings.
7. The system of claim 1 , wherein the baseline configuration file specifies a schedule associated with a deployment of the baseline configuration file.
8. A computer-implemented method for machine policy enforcement, comprising:
obtaining, by a client device, a baseline configuration file from a computing device associated with a management service, the baseline configuration file comprising a list of policies associated with an operating system of the client device, and the baseline configuration file being obtained from a command queue of the computing device; and
applying, by the client device, the list of policies for the client device by modifying a registry of the operating system in accordance with the list of policies.
9. The computer-implemented method of claim 8 , wherein a particular policy in the list of policies is a non-registry policy, and applying particular policy further comprises generating a command-line input to apply the particular policy using a command line of the operating system.
10. The computer-implemented method of claim 8 , wherein the baseline configuration file comprises an extensible markup language (XML).
11. The computer-implemented method of claim 8 , further comprising detecting a change to the registry that differs from a policy in the list of policies.
12. The computer-implemented method of claim 11 , further comprising reapplying the baseline configuration file in an instance in which the change is detected.
13. The computer-implemented method of claim 8 , wherein the list of policies comprises a plurality of Group Policy settings.
14. The computer-implemented method of claim 8 , wherein the baseline configuration file specifies a schedule associated with a deployment of the baseline configuration file.
15. A non-transitory computer-readable medium embodying a program executable in a client device, wherein when executed, the program causes the client device to at least:
obtain a baseline configuration file from a computing device associated with a management service, the baseline configuration file comprising a list of policies associated with an operating system of the client device, and the baseline configuration file being obtained from a command queue of the computing device; and
apply the list of policies for the client device by modifying a registry of the operating system in accordance with the list of policies.
16. The non-transitory computer-readable medium of claim 15 , wherein a particular policy in the list of policies is a non-registry policy, and applying particular policy further comprises generating a command-line input to apply the particular policy using a command line of the operating system.
17. The non-transitory computer-readable medium of claim 15 , wherein the baseline configuration file comprises an extensible markup language (XML).
18. The non-transitory computer-readable medium of claim 15 , wherein, when executed, the program further causes the client device to at least:
detect a change to the registry that differs from a policy in the list of policies; and
reapply the baseline configuration file in an instance in which the change is detected.
19. The non-transitory computer-readable medium of claim 15 , wherein the list of policies comprises a plurality of Group Policy settings.
20. The non-transitory computer-readable medium of claim 15 , wherein the baseline configuration file specifies a schedule associated with a deployment of the baseline configuration file.