Group Policy (GPO) Master Guide for SystemAdministrators

-
Group Policy (GPO) Master Guide for System
Administrators
This guide contains 50+ real-world Group Policy configurations used by IT administrators. These
policies help manage security, software deployment, user restrictions, and automation. Useful for
System Admin jobs, Windows Server, and Azure Administrator (AZ-104).
1. Disable USB Storage
Path: Computer Configuration → Administrative Templates → System → Removable Storage
Access
2. Enforce Password Policy
Path: Computer Configuration → Windows Settings → Security Settings → Account Policies
3. Map Network Drive Automatically
Path: User Configuration → Preferences → Windows Settings → Drive Maps
4. Deploy Software Automatically
Path: Computer Configuration → Software Settings → Software Installation
5. Set Desktop Wallpaper
Path: User Configuration → Administrative Templates → Desktop → Desktop Wallpaper
6. Disable Control Panel
Path: User Configuration → Administrative Templates → Control Panel
7. Disable Command Prompt
Path: User Configuration → Administrative Templates → System
8. Disable Registry Editor
Path: User Configuration → Administrative Templates → System
9. Configure Windows Updates
Path: Computer Configuration → Administrative Templates → Windows Components → Windows
Update
10. Run Logon Script Path: User Configuration → Windows Settings → Scripts
11. Run Startup Script
Path: Computer Configuration → Windows Settings → Scripts
12. Auto Lock Computer
Path: User Configuration → Administrative Templates → Control Panel → Personalization
13. Disable Task Manager
Path: User Configuration → Administrative Templates → System → Ctrl+Alt+Del Options
14. Configure Firewall
Path: Computer Configuration → Windows Settings → Security Settings → Windows Defender
Firewall
15. Install Printers Automatically
Path: User Configuration → Preferences → Control Panel Settings → Printers
16. Folder Redirection
Path: User Configuration → Windows Settings → Folder Redirection
17. Restrict Software Installation
Path: Computer Configuration → Administrative Templates → Windows Installer
18. Disable USB but Allow Keyboard/Mouse
Path: Computer Configuration → Administrative Templates → System → Device Installation
Restrictions
19. Configure BitLocker
Path: Computer Configuration → Administrative Templates → Windows Components → BitLocker
Drive Encryption
20. Hide Drives in Explorer
Path: User Configuration → Administrative Templates → Windows Components → File Explorer
21. Disable Windows Store
Path: Computer Configuration → Administrative Templates → Windows Components → Store 22. Configure Proxy Settings
Path: User Configuration → Preferences → Control Panel Settings → Internet Settings
23. Restrict Login Hours
Path: Computer Configuration → Windows Settings → Security Settings → Local Policies
24. Enable Audit Policy
Path: Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy
25. Disable Autorun
Path: Computer Configuration → Administrative Templates → Windows Components → AutoPlay
Policies
26. Prevent Access to Settings
Path: User Configuration → Administrative Templates → Control Panel
27. Configure Remote Desktop
Path: Computer Configuration → Administrative Templates → Windows Components → Remote
Desktop Services
28. Block Specific Applications
Path: User Configuration → Administrative Templates → System → Don't run specified applications
29. Enable Screen Saver Password
Path: User Configuration → Administrative Templates → Control Panel → Personalization
30. Disable Guest Account
Path: Computer Configuration → Windows Settings → Security Settings → Local Policies
31. Rename Administrator Account
Path: Computer Configuration → Windows Settings → Security Settings → Local Policies
32. Disable Shutdown Option
Path: User Configuration → Administrative Templates → Start Menu and Taskbar
33. Configure Power Settings
Path: Computer Configuration → Preferences → Control Panel Settings → Power Options 34. Deploy Scheduled Task
Path: Computer Configuration → Preferences → Control Panel Settings → Scheduled Tasks
35. Configure WiFi Profile
Path: Computer Configuration → Preferences → Control Panel Settings → Network Options
36. Disable Cortana
Path: Computer Configuration → Administrative Templates → Windows Components → Search
37. Enable Defender Antivirus
Path: Computer Configuration → Administrative Templates → Windows Components → Microsoft
Defender Antivirus
38. Configure Lock Screen
Path: Computer Configuration → Administrative Templates → Control Panel → Personalization
39. Disable USB Write Access
Path: Computer Configuration → Administrative Templates → System → Removable Storage
Access
40. Enable Event Log
Path: Computer Configuration → Windows Settings → Security Settings → Event Log
41. Configure Network Security
Path: Computer Configuration → Windows Settings → Security Settings → Local Policies
42. Disable Bluetooth
Path: Computer Configuration → Administrative Templates → System → Device Installation
Restrictions
43. Control Updates via WSUS
Path: Computer Configuration → Administrative Templates → Windows Components → Windows
Update
44. Enable Login Banner
Path: Computer Configuration → Windows Settings → Security Settings → Local Policies 45. Disable Edge Browser
Path: Computer Configuration → Administrative Templates → Windows Components → Microsoft
Edge
46. Configure Account Lockout
Path: Computer Configuration → Windows Settings → Security Settings → Account Policies
47. Prevent Password Saving
Path: Computer Configuration → Administrative Templates → System → Credentials Delegation
48. Enable SmartScreen
Path: Computer Configuration → Administrative Templates → Windows Components → File
Explorer
49. Disable OneDrive
Path: Computer Configuration → Administrative Templates → Windows Components → OneDrive
50. Configure DNS Settings
Path: Computer Configuration → Preferences → Control Panel Settings → Network Options

Comments

Post a Comment

Popular posts from this blog

IIS Installation and Application configuration windows swerver

-
Image
  1.      Using the Server Manager, select  2 Add roles and features . Figure 4-9 Server Manager – Adding Roles and Features Select  Role-based or feature-based installation , and then click  Next . Choose  Select a server from the server pool . 4.      Select the server you are configuring, and then click  Next . Figure 4-10 Server Manager – Select Server 5.      Expand the  Web Server  role service. Figure 4-11 Server Manager – Web Server Role Services Expand the  Web Server  options and select the following  Common HTTP Features : ·         Default Document ·         ·         HTTP Errors ·         ·         Static Content · ...
Read more

Here’s a step-by-step guide on configuring WDS on Windows Server

-
Windows Deployment Services (WDS) is a Microsoft tool for network-based installation of Windows operating systems. It enables administrators to deploy Windows images over a network to computers without requiring physical media. Here’s a step-by-step guide on configuring WDS on Windows Server: Prerequisites: A Windows Server machine with WDS role installed. Active Directory, DNS, and DHCP set up and running on the network. An NTFS partition on the server to store images. Step 1: Install WDS Role Open Server Manager and go to Manage > Add Roles and Features . Click Next until you reach the Server Roles page. Select Windows Deployment Services and click Next . Choose WDS Deployment Server and WDS Transport Server and click Next . Complete the wizard to install the role, then restart the server if prompted. Step 2: Configure Windows Deployment Services Open WDS by navigating to Server Manager > Tools > Windows Deployment Services . In the WDS console, right-click on your se...
Read more

✅ Step-by-Step: Create & Install Self-Signed Certificate in PowerShell

-
✅ Step-by-Step: Create & Install Self-Signed Certificate in PowerShell 🟦 Step 1: Open PowerShell as Administrator 1. Click Start 2. Search PowerShell 3. Right-click → Run as Administrator 🟦 Step 2: Create a Self-Signed Certificate Use this command: New-SelfSignedCertificate -DnsName "test.local" -CertStoreLocation "Cert:\LocalMachine\My" 🔍 What this does: Generates a certificate for domain test.local Saves it under Local Machine → Personal → Certificates 🟦 Step 3: Export Certificate With Private Key (Optional) If you want a .pfx (for IIS / apps), run: 3.1 Set a password $mypwd = ConvertTo-SecureString -String "P@ssw0rd123" -Force -AsPlainText 3.2 Export to PFX Export-PfxCertificate -Cert "Cert:\LocalMachine\My\<Thumbprint>" ` -FilePath "C:\certs\mycert.pfx" -Password $mypwd 👉 Replace <Thumbprint> with your certificate’s real thumbprint: Get-ChildItem Cert:\LocalMachine\My 🟦 Step 4: Export .CER (For Trusted Root Ins...
Read more