Lesson 6 — Group Policy (GPO)

A Group Policy Object (GPO) is a collection of settings that can be applied to computers and/or users in an AD domain. GPOs are linked to Sites, Domains, or Organizational Units (OUs).

• GPO settings are stored in two locations:
  • GPC (Group Policy Container) — AD object in NTDS.DIT storing metadata
  • GPT (Group Policy Template) — Files in \\domain\SYSVOL\domain\Policies\{GUID}\ storing the actual policy data
• GPOs are processed every 90 minutes (±30 min random offset) on workstations/servers
• DCs process GPOs every 5 minutes
• Computer policies apply at startup; User policies apply at logon

When multiple GPOs apply to an object, they are processed in this order. Later-processed policies win when there is a conflict (OU GPOs have highest priority):

Special Processing Modifiers

# Install GPMC (if not already present)
Install-WindowsFeature -Name GPMC

# Open GPMC
gpmc.msc

# Key operations in GPMC:
# Right-click domain/OU → Create a GPO in this domain and Link it here
# Right-click domain/OU → Link an Existing GPO (reuse an existing GPO)
# Right-click GPO → Edit (opens Group Policy Management Editor)
# Right-click GPO → GPO Status (enable/disable Computer or User configuration)
# Group Policy Results wizard — what policies actually applied to a specific user/computer

Default Built-in GPOs

Every GPO has two sections. Understanding which to use is fundamental:

# GPO path structure in GPMC editor:
# Computer Configuration
#   ├── Policies
#   │   ├── Windows Settings
#   │   │   ├── Security Settings
#   │   │   │   ├── Account Policies (Password, Lockout, Kerberos)
#   │   │   │   ├── Local Policies (Audit, User Rights, Security Options)
#   │   │   │   └── Windows Firewall with Advanced Security
#   │   │   └── Scripts (Startup/Shutdown)
#   │   └── Administrative Templates (Registry-based policies)
#   │       ├── Windows Components
#   │       ├── System
#   │       └── Network
#   └── Preferences (persistent settings, not enforced like Policies)

# User Configuration
#   ├── Policies
#   │   ├── Windows Settings
#   │   │   ├── Scripts (Logon/Logoff)
#   │   │   └── Folder Redirection
#   │   └── Administrative Templates
#   └── Preferences
#       ├── Drive Maps (map network drives)
#       ├── Registry
#       ├── Files and Folders
#       └── Shortcuts

Password Policy

Located: Computer Config → Policies → Windows Settings → Security Settings → Account Policies → Password Policy

Must be set in the Default Domain Policy (domain-level, not OU-level, unless using Fine-Grained Password Policies).

Account Lockout Policy

Audit Policy Settings

Located: Computer Config → Policies → Windows Settings → Security Settings → Local Policies → Audit Policy (or Advanced Audit Policy Configuration for more granularity)

Disable USB Storage Devices

Computer Config → Policies → Windows Settings → Security Settings → System Services, or Administrative Templates:

# GPO Path: Computer Configuration → Policies → Administrative Templates →
#   System → Removable Storage Access
# Setting: "All Removable Storage classes: Deny all access" → Enabled

# Alternative via registry (also deployable via GPO Preferences):
# HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR
# Start = 4 (disabled) instead of 3 (enabled)

Screen Lock / Password on Wake

# GPO Path: Computer Configuration → Policies → Administrative Templates →
#   Control Panel → Personalization
# Settings:
# "Enable screen saver"           → Enabled
# "Screen saver timeout"          → Enabled, 900 seconds (15 min)
# "Password protect the screen saver" → Enabled
# "Force specific screen saver"   → Enabled, scrnsave.scr (blank screen)

Disable Control Panel for Standard Users

# GPO Path: User Configuration → Policies → Administrative Templates →
#   Control Panel
# Setting: "Prohibit access to Control Panel and PC Settings" → Enabled

Map a Network Drive via GPO Preferences

# GPO Path: User Configuration → Preferences → Windows Settings → Drive Maps
# New → Mapped Drive:
# Action: Create (or Update)
# Location: \\SRV-FILE01\Shared
# Drive Letter: S:
# Label: Company Share
# Reconnect: Checked
# Item-level targeting: "Group" → GG-IT-Staff (only applies to IT group)

Configure Windows Update via GPO

# GPO Path: Computer Configuration → Policies → Administrative Templates →
#   Windows Components → Windows Update

# Key settings:
# "Configure Automatic Updates" → Enabled
#   Option: 4 - Auto download and schedule the install
#   Schedule: Every Sunday at 3:00 AM
# "Specify intranet Microsoft update service location" → Enabled
#   Set update service: http://WSUS-SERVER:8530
# "No auto-restart with logged on users" → Enabled (avoid surprise reboots)

GPO can deploy MSI packages to computers (at startup) or users (at logon). The MSI must be in a network share accessible by the target computers.

# Requirements for GPO software deployment:
# 1. MSI file must be on a UNC network share: \\SRV-FILE01\Software\App.msi
# 2. Share must be readable by computer accounts (DOMAIN\Domain Computers)
# 3. NTFS permissions must also allow read access

# GPO Path: Computer Configuration → Policies → Software Settings → Software Installation
# Right-click → New → Package
# Browse to UNC path: \\SRV-FILE01\Software\App.msi
# Deployment method:
#   - Assigned: Installs automatically, appears in Start menu, installed if user clicks shortcut
#   - Published (User Config only): Available in Control Panel → Programs but not auto-installed

# Verify deployment after gpupdate
Get-WinEvent -FilterHashtable @{LogName='Application'; ProviderName='MsiInstaller'} -MaxEvents 20 |
  Select-Object TimeCreated, Message | Format-List

Folder Redirection moves Windows user profile folders (Desktop, Documents, Downloads, etc.) from the local machine to a network share. Users' data is then centrally stored and backed up automatically.

# Prerequisites:
# 1. Create file share: \\SRV-FILE01\UserFolders$  (dollar sign = hidden share)
# 2. Share permissions: Domain Users = Full Control (NTFS permissions manage real access)
# 3. NTFS permissions on folder:
#    - CREATOR OWNER: Full Control (subfolders and files only)
#    - Domain Users: List folder / Read data + Create folders (this folder only)

# GPO Path: User Configuration → Policies → Windows Settings → Folder Redirection
# Right-click "Documents" → Properties
# Setting: Basic - Redirect everyone's folder to the same location
# Target folder location: Create a folder for each user under the root path
# Root Path: \\SRV-FILE01\UserFolders$
# (Result: \\SRV-FILE01\UserFolders$\%username%\Documents)
# Check "Grant the user exclusive rights" and "Move the contents to the new location"

# Computer Configuration → Policies → Windows Settings → Scripts (Startup/Shutdown)
# Startup scripts run as SYSTEM before login screen appears
# Shutdown scripts run as SYSTEM before machine powers off

# User Configuration → Policies → Windows Settings → Scripts (Logon/Logoff)
# Logon scripts run as the user after successful logon
# Logoff scripts run as the user when they log off

# Scripts must be placed in the GPO's script folder:
# \\domain\SYSVOL\domain\Policies\{GUID}\Machine\Scripts\Startup\
# \\domain\SYSVOL\domain\Policies\{GUID}\User\Scripts\Logon\

# Example startup script (sets firewall rule):
# startup.ps1
New-NetFirewallRule -DisplayName "Block TeamViewer" -Direction Outbound `
  -RemotePort 5938 -Protocol TCP -Action Block -Profile Any

# Example logon script (map drives based on group membership):
# logon.ps1
$groups = (New-Object System.DirectoryServices.DirectorySearcher(
    [adsi]"",[string]::Format("(&(objectCategory=User)(sAMAccountName={0}))",$env:USERNAME),
    "memberOf")).FindOne().Properties["memberOf"]

if ($groups -match "GG-IT-Staff") {
    net use I: \\SRV-FILE01\IT /persistent:no
}
if ($groups -match "GG-HR-Staff") {
    net use H: \\SRV-FILE01\HR /persistent:no
}

Security Filtering

By default, "Authenticated Users" is in the Security Filtering of every GPO — meaning it applies to all users and computers. Replace this to target a specific group:

# GUI: In GPMC, select the GPO → Scope tab → Security Filtering
# Remove "Authenticated Users" → Add "GG-IT-Staff"
# This GPO now only applies to members of GG-IT-Staff

# PowerShell equivalent:
$gpName = "IT-Workstation-Policy"
Set-GPPermissions -Name $gpName -PermissionLevel GpoApply `
  -TargetName "GG-IT-Staff" -TargetType Group
Set-GPPermissions -Name $gpName -PermissionLevel None `
  -TargetName "Authenticated Users" -TargetType Group

WMI Filters

WMI Filters apply a GPO only when a WMI query returns TRUE. This lets you target GPOs based on OS version, hardware, or other conditions.

# Example WMI Filters (WQL syntax):
# Apply only to Windows 10 machines:
SELECT * FROM Win32_OperatingSystem WHERE Caption LIKE "%Windows 10%"

# Apply only to laptops (systems with a battery):
SELECT * FROM Win32_Battery

# Apply only to 64-bit systems:
SELECT * FROM Win32_OperatingSystem WHERE OSArchitecture = "64-bit"

# Apply only to systems with more than 8GB RAM:
SELECT * FROM Win32_PhysicalMemory WHERE Capacity >= 8589934592

# Link WMI filter to GPO:
# In GPMC, select the GPO → Scope tab → WMI Filtering → select your filter from dropdown

# Force immediate GPO refresh on local machine
gpupdate /force              # Refreshes both Computer and User policies
gpupdate /target:computer    # Only Computer Configuration
gpupdate /target:user        # Only User Configuration
gpupdate /boot               # Apply policies requiring restart and reboot
gpupdate /logoff             # Apply policies requiring logoff and logoff

# Get applied GPOs for the CURRENT computer and CURRENT user
gpresult /r                  # Summary in console
gpresult /h C:\GPReport.html # Full HTML report with all settings and status
gpresult /v                  # Verbose — shows every applied setting

# Remote: get GPO results for a specific user/computer
gpresult /s SRV-WEB01 /user LAB\jsmith /h C:\Reports\jsmith_gpo.html

# RSOP (Resultant Set of Policy) — older GUI tool
rsop.msc

# Check GPO event logs
# Event Viewer → Applications and Services Logs → Microsoft → Windows → Group Policy → Operational
Get-WinEvent -LogName "Microsoft-Windows-GroupPolicy/Operational" -MaxEvents 20 |
  Select-Object TimeCreated, LevelDisplayName, Message | Format-List

# Verify SYSVOL replication (GPOs won't apply if SYSVOL is not replicated)
dfsrdiag ReplicationState
Get-DfsrConnection | Select-Object GroupName, SendingMember, ReceivingMember, State

Common GPO Issues and Fixes