Group Policy Management and GPOs

Group Policy

• The Active Directory directory service uses Group Policy to manage users and computers in a network.
• Group Policy defines the state of a user’s work environment.
• Group Policy settings can be applied to entire organizations or specific groups of users and computers.

Group Policy Objects (GPOs)

• Group Policy Object (GPO) specifies one or more policies.
• Each GPO includes a Globally Unique Identifier (GUID).
• GPO controls computer configuration, user environment, and account policies.

Operation on GPOs

• GPO can be created using Active Directory Users and Computers, Group Policy Management Console, or Active Directory Sites And Services.
• GPOs are applied by linking them to sites, domains, or organizational units using Group Policy Management Console.
• The Group Policy Object Editor snap-in modifies the default settings for GPs.

Types of Group Policies

• Local Group Policy is used to configure the Group Policy on a single local computer.
• Active Directory Group Policy is created in the Active Directory to control linked objects such as Domains, Sites, and OUs.
• Active Directory group policies override local group policies.
• Most Group Policies update and manage Registry configuration data.

User Configuration & Computer Configuration Nodes

• Both Computer Configuration and User Configuration nodes contain Software Settings, Windows Settings, and Administrative Templates nodes.
• Software Settings apply to user/computer and software installation settings.
• Windows Settings apply to user/computer and includes Security Settings and Scripts.
• Administrative Templates contain registry-based GP settings.

What Happens When Local and AD GPOs Conflict?

• When Local GPO and AD GPOs conflict, the application order impacts the final policy.
• The order is:
  • Local GPO is applied first.
  • Site GPOs are applied.
  • Domain policies are applied.
  • Organizational unit and child organizational unit policies are applied.

Inheritance

• Group policies are passed down from parent to child containers within a domain.
• If a GPO is set to Enabled or Disabled in a parent container but not in a child container, the parent GPO is applied.
• If a GPO is set in both the parent and child container, and there is no conflict, both parent and child GPOs apply.
• If a GPO is set in both the parent and child container, and there is conflict, the child GPO applies.
• If a conflict occurs between a user policy and a computer policy, the computer policy applies.
• The Resultant Set of Policies (RSoP) is the total impact of all cumulative policies.

Exceptions of Inheritance

• Administrators can block inheritance.
• If a computer is a Workgroup member, only the local GP applies.
• Administrators can disable overriding.
• If a GPO is set to No Override for a site, domain, or OU, then its policy settings will not be overridden.
• If more than one GPO is set to No Override, the GPO highest in the AD hierarchy takes precedence.
• Policies will always override a user configuration or a script.

Explore the essentials of Group Policy management in Active Directory. This quiz covers the creation, application, and types of Group Policy Objects (GPOs) and how they affect user and computer settings within a network. Test your knowledge of Group Policy functionality and administration.