Windows Group Policy (GPO) Explanation and Tutorials

Group Policy Object (GPO) is a Windows feature for centrally configuring operating systems, users, and applications. Group Policies allow you to apply the same settings to all users and computers in an Active Directory domain by providing a set of rules and settings for the Windows environment. You can use Group Policy to set Windows configuration, change security settings, configure the user’s environment, install a program or run a script, etc.

Group Policy Architecture and Components

  • GPO – a Group Policy Settings object, which contains a set of settings that you want to apply to workstations, servers and/or users. Each GPO in a domain has its own unique GUID. Its files are stored in the SYSVOL directory on Active Directory domain controllers ( \\woshub.com\SYSVOL\woshub.com\Policies\GPO_GUID). All AD domain controllers replicate the GPO folder in Sysvol;
  • Client computers – Clients retrieve GPO files from domain controllers and apply settings to Windows and users. The process of obtaining and applying a GPO is called a Group Policy Update;
  • Group Policy Administrative Templates (ADMX files) are the XML template files for the GPO Editor.  ADMX files contain the definitions of the policy settings, which describe what settings can be configured and what their valid values are. Third party developers and administrators can create their own ADMX templates. If you want to support multiple languages in ADMX, you can use ADML files. You can install and update administrative templates for a wide range of applications and services. For example, you can use ADMX templates for Microsoft Office, to configure the settings of the Google Chrome browser, manage LAPS, etc.   In a Windows domain, we recommend that you create a central Administrative Template store for ADMX files called PolicyDefinitions.
  • Linking GPO – a configured GPO can be assigned to an entire domain, an Active Directory site, or an Organizational Unit in the AD tree structure; Windows Group Policies (GPO) in Active Directory
  • GPO Security Filtering and WMI Filters allow you to limit the scope of a GPO to specific computers, users, and groups;
  • Group Policy Preferences – a built-in set of client extensions that extend the capabilities of GPO (available in Windows Server 2008 and later).

There are two default GPOs created in the domain:

  • Default Domain Policy – Assigned to the root of the domain and contains basic settings for all users and computers. It includes domain password policy settings, account lockout, and Kerberos settings.
  • Default Domain Controller Policy – contains the basic and auditing settings for the Active Directory domain controller.

Group Policy Management Tools

MostUsefulGPOExamplesandBestPractices

Examples of using Group Policy Preferences:

Group Policy Troubleshooting Guides