Group Policy Objects Guide
Group Policy Objects Guide
Group Policy is a feature of Active Directory that allows administrators to centrally manage settings for users and computers. Settings are stored in Group Policy Objects (GPOs) and applied to OUs, domains, or sites.
How GPO Processing Works
GPOs are processed in this order (LSDOU):
- Local: The local GPO on each computer is processed first.
- Site: GPOs linked to the AD site.
- Domain: GPOs linked to the domain.
- OU: GPOs linked to the OU (parent OUs first, then child OUs).
If settings conflict, the last GPO applied wins (closest OU to the object).
Creating a GPO
- Open Active Directory Users and Computers.
- Right-click the target OU → Properties → Group Policy tab.
- Click New to create a GPO, then Edit to open the Group Policy Editor.
Common GPO Settings
| Category | Setting | Path |
|---|---|---|
| Password Policy | Minimum password length | Computer → Windows Settings → Security Settings → Account Policies → Password Policy |
| Account Lockout | Lockout threshold | Computer → Windows Settings → Security Settings → Account Policies → Account Lockout Policy |
| Desktop | Remove Run from Start menu | User → Administrative Templates → Start Menu & Taskbar |
| Software | Assign applications | Computer → Software Settings → Software Installation |
| Scripts | Logon script | User → Windows Settings → Scripts (Logon/Logoff) |
Troubleshooting GPOs
REM Force Group Policy refresh secedit /refreshpolicy machine_policy secedit /refreshpolicy user_policy REM View applied GPOs (Windows XP / Server 2003+) gpresult /v REM On Windows 2000, use the Resource Kit tool: gpresult.exe
Block Inheritance and No Override
- Block Policy Inheritance: Prevents parent GPOs from applying to a child OU. Use sparingly.
- No Override: Forces a GPO to apply even if a child OU blocks inheritance. Domain-level security policies often use this.