Group Policy
Group Policy is Windows infrastructure for centrally configuring users and computers. In an Active Directory domain, administrators place settings in Group Policy Objects and link them to sites, domains, or organizational units so clients can calculate and apply the settings in scope.
itWindows and Microsoft infrastructure | OpenSkills.info
Intro
Group Policy
Group Policy is a Windows configuration system. It lets administrators define computer and user settings once, place them in a Group Policy Object (GPO), and apply them across an Active Directory Domain Services environment. A local GPO can also configure one Windows computer without a domain.
The name can be misleading. A domain GPO does not attach directly to an Active Directory group. Administrators link it to a site, domain, or organizational unit (OU), then use permissions or a Windows Management Instrumentation (WMI) filter to narrow which users and computers can apply it.
Architecture: one object, two stored parts
A domain GPO is a logical object with two synchronized parts:
- The Group Policy container (GPC) is an Active Directory object. It holds metadata such as the GPO identifier, version, status, permissions, and references to client-side extensions.
- The Group Policy template (GPT) is a folder under the domain's SYSVOL share. It holds file-based policy data, scripts, security settings, and a version file.
Active Directory replication carries the container. SYSVOL replication carries the template. Clients need both parts to represent the same GPO version. A replication or connectivity problem can therefore make a correct setting appear missing or stale.
Administrative Template files do not store configured policy values. ADMX files define the settings that editors display, while language-specific ADML files provide localized text. A domain Central Store under SYSVOL gives administrators a shared template set. The templates expose settings; the GPO stores the choices made with those settings.
Continue the course
This section is part of the paid course.
See pricing to subscribe, or log in if you already have access.
Where this skill leads
Relevant careers
See how this topic contributes to broader role-level skill maps.
Sources
- https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/group-policy/group-policy-overview
Supports
- Group Policy purpose, core concepts, Windows and Active Directory scope
- Computer and user configuration and common administrative uses
- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gpod/260b58dc-da14-400b-8b82-6abbfd529fbf
Supports
- GPO logical structure, Group Policy container, Group Policy template, versions, ACLs, and client-side extension references
- Active Directory and SYSVOL storage paths
- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gpol/396785e8-c3cb-499f-befa-26bcc953fde5
Supports
- Creation of both the Active Directory groupPolicyContainer and corresponding SYSVOL directory
- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gpod/4b293f38-2e0b-48e6-9df6-ec3fd8c48512
Supports
- Scope of management from site, domain, and OU links
- Link order and policy-target discovery
- https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/group-policy/group-policy-processing
Supports
- Local, site, domain, and OU processing order
- Inheritance, Enforced, Block Inheritance, security filtering, WMI filtering, loopback, and refresh
- https://learn.microsoft.com/en-us/previous-versions/windows/desktop/policy/applying-group-policy
Supports
- Startup, sign-in, periodic, and on-demand policy application
- Directory lookup, ACL evaluation, processing order, and foreground-only application deployment
- https://learn.microsoft.com/en-us/previous-versions/windows/desktop/policy/initial-processing-of-group-policy
Supports
- Foreground computer startup and user sign-in processing
- Synchronous and asynchronous processing behavior
- https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/group-policy/group-policy-management-console
Supports
- GPMC capabilities, permissions, GPO creation, editing, links, backup, reporting, modeling, and results
- GPO links to sites, domains, and OUs rather than storage in those containers
- https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/group-policy/group-policy-modeling-results
Supports
- Difference between simulated Group Policy Modeling and observed Group Policy Results
- gpresult HTML output and winning GPO evidence
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/gpresult
Supports
- Resultant Set of Policy output, report modes, scopes, and examples
- https://learn.microsoft.com/en-ca/troubleshoot/windows-server/group-policy/applying-group-policy-troubleshooting-guidance
Supports
- gpresult, Application and System logs, Group Policy Operational log, and processing Activity ID
- Optional GPSvc logging and targeted refresh commands
- https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/group-policy/group-policy-preferences
Supports
- Group Policy Preference item-level targeting
- Security group, site, registry, time, user, and WMI targeting conditions with logical combinations
- https://learn.microsoft.com/en-us/previous-versions/windows/desktop/policy/admx-schema
Supports
- ADMX language-neutral definitions and ADML language resources beginning with Windows Vista
- https://learn.microsoft.com/en-us/troubleshoot/windows-client/group-policy/create-and-manage-central-store
Supports
- Central Store location, ADMX and ADML organization, editor lookup, replication, and repository guidance
- https://learn.microsoft.com/en-us/troubleshoot/windows-server/group-policy/manage-group-policy-adm-file
Supports
- Historical ADM storage in each GPT and transition to the Vista ADMX and ADML model
- Separate Active Directory and SYSVOL replication concerns
- https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/group-policy/group-policy-backup-restore
Supports
- GPO backup, restore, copy, import, migration, and recovery purpose
- https://learn.microsoft.com/en-us/powershell/module/grouppolicy/
Supports
- Supported Group Policy cmdlets for reports, backup, links, permissions, RSoP, and remote refresh
- https://learn.microsoft.com/en-us/intune/device-configuration/import-group-policy-analytics
Supports
- Importing GPO XML reports, MDM support mapping, deprecated and unknown settings, migration readiness, and settings catalog migration
- Limits involving supported CSPs and language
- https://github.com/sindresorhus/awesome
Supports
- Starting point for awesome-list discovery and Windows list routing
- https://github.com/awesome-foss/awesome-sysadmin
Supports
- Discovery of Samba, opsi, and Chocolatey as identity, client-management, or Windows package-management projects
- https://wiki.samba.org/index.php/Group_Policy
Supports
- Group Policy administration in Samba AD, ADMX loading, GPO creation and linking, and Windows and Linux member processing
- https://docs.opsi.org/opsi-docs-en/4.3/index.html
Supports
- Windows and Linux client management, inventory, software distribution, operating-system deployment, and patching
- https://docs.chocolatey.org/en-us/guides/organizations/organizational-deployment-guide/
Supports
- Organization package repositories, endpoint agents, reporting, package deployment, and PowerShell deployment actions
- https://news.microsoft.com/source/2000/02/17/gates-ushers-in-next-generation-of-pc-computing-with-launch-of-windows-2000/
Supports
- February 2000 worldwide availability of Windows 2000 Professional and Server
- https://learn.microsoft.com/en-us/previous-versions/windows/desktop/gpmc/group-policy-management-console-portal
Supports
- GPMC unification of previously separate tools, backup, reporting, RSoP, and programmatic interfaces
- https://download.microsoft.com/download/a/1/4/a143262c-4912-460c-9c88-d797c749a05f/WS03_Partner_Salessheet.pdf
Supports
- Windows Server 2003 positioning of GPMC and Group Policy enhancements
- https://download.microsoft.com/download/3/C/A/3CA09191-CDC7-4DD2-BC80-D837D2733457/AGPM25_Step-by-Step_Guide.pdf
Supports
- May 2007 AGPM 2.5 guide and controlled GPO workflow
- https://learn.microsoft.com/en-us/previous-versions/windows/desktop/policy/new-for-group-policy
Supports
- Group Policy Preferences and Starter GPOs for Windows Vista and Windows Server 2008
- https://news.microsoft.com/source/2008/02/27/wave-of-new-microsoft-enterprise-products-bring-big-benefits-to-it-professionals-and-developers/
Supports
- February 2008 Windows Server 2008 launch
- https://news.microsoft.com/source/2009/07/22/microsoft-releases-windows-7-and-windows-server-2008-r2/
Supports
- July 2009 release to manufacturing and October 2009 general availability of Windows Server 2008 R2
- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn265973%28v%3Dws.11%29
Supports
- Windows Server 2012 Invoke-GPUpdate, remote refresh, Server Core cmdlets, and Group Policy processing changes
- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj134201%28v%3Dws.11%29
Supports
- Central remote Group Policy refresh in Windows Server 2012 and Windows 8
- https://techcommunity.microsoft.com/blog/intunecustomersuccess/resolved---group-policy-objects-from-past-releases-of-group-policy-analytics-are/1695806
Supports
- September 2020 Group Policy analytics public preview
- April 2022 public preview of migration from imported GPOs to Settings Catalog policy
- https://www.microsoft.com/en-us/security/business/endpoint-management/microsoft-intune
Supports
- Paid proprietary Intune endpoint and policy management offering
- https://www.quest.com/products/gpoadmin
Supports
- GPO change control, approvals, version comparison, protected settings, rollback, audit trails, and Intune readiness
- Paid proprietary product positioning
- https://www.netwrix.com/endpoint_management_software.html
Supports
- Group Policy extension, MDM delivery, non-domain endpoint policy, application control, and least privilege
- Paid proprietary endpoint licensing
- https://www.manageengine.com/products/ad-manager/gpo-management-guide.html
Supports
- GPO creation, editing, links, and reporting from ADManager Plus
- https://www.manageengine.com/products/ad-manager/
Supports
- Proprietary ADManager Plus product and free and paid editions