Department of Veterans Affairs Improves Security and Achieves Compliance

After evaluating the offerings on the market, the VA chose Netwrix PolicyPak Group Policy Edition as the best-of-breed solution. Its out-of-the-box support for a diverse set of applications was a key to budgetary approval. Deployment across its 500,000+ endpoints was quick and  smooth, enabling the VA to achieve the following benefits:

Easier application management. PolicyPak enables the IT team to maintain consistent settings for third-party applications and save a great deal of time on app maintenance. “Before PolicyPak, it would have been extremely difficult and time consuming to apply a newly released patch for Adobe Reader, for instance — we would have had to do a full uninstall followed by a full re-install every time Adobe updated the product,” explains Jamie Hosley, Office of Information and Technology at the VA. In fact, the team plans to use PolicyPak Design Studio to control the settings for a number of custom apps as well. “The more settings we can lock down, the fewer support calls we will have to handle,” Hosley says.

Support for multiple browsers. The VA was able to set Chrome as a default browser for the entire organization while routing specific applications to be opened in other browsers for compatibility reasons. For example, legacy applications open in Internet Explorer because they run best there. “Once the routing is made, an application will always open in the correct browser, even if someone already has a different browser open,” says Hosley.

Tighter security. PolicyPak makes it easy to apply security settings and lock down resources, while also providing the flexibility to define exceptions when a project requires unique settings. In addition, the IT team can enforce least privilege by preventing users from downloading unapproved versions of browsers, and can ensure that applications are distributed only through the corporate configuration manager, not random websites that might be spreading malware. “Microsoft’s AppLocker is not a good fit for our needs,” Hosley says. “We prefer the simple to use and seamless security settings we can put in place using PolicyPak.”

Easier Windows 10 deployment. PolicyPak made it much easier for the VA to implement Windows 10 across its endpoints. “PolicyPak makes it extremely easy to apply file associations,” Hosley says. “For example, we can control whether PDF files are associated with Adobe Reader or the full version of Adobe Acrobat, based on which tool is installed on a particular machine.”

Better GPO management. PolicyPak enabled VA to consolidate the dozens of GPOs assigned to each kiosk to a single GPO and to eliminate unneeded GPOs that have accumulated over the years. “We had GPOs that applied to applications or configurations that are no longer in use, but people were resistant to touching them because there might be a dependency somewhere,” Hosley says. “PolicyPak makes it easy to turn those legacy GPOs off, see what happens and make any adjustments that might be needed.”