Chapter 2 - Active Directory & GPO Architecture

-

 Windows Server Group Policy (GPO) Master Handbook

Chapter 2 - Active Directory & GPO Architecture

Chapter Objectives

Understand how Active Directory stores, processes, and applies Group Policy Objects (GPOs), and how Domain Controllers, SYSVOL, Organizational Units (OUs), and replication work together.

1. Active Directory Overview

Active Directory Domain Services (AD DS) is Microsoft's directory service that stores users, computers, groups, printers, and policies. GPOs rely on AD DS to determine where policies are linked and to which users or computers they apply.

2. Active Directory Components

Forest: Highest security boundary.
Tree: One or more related domains.
Domain: Administrative and authentication boundary.
Organizational Unit (OU): Logical container used to organize users and computers and link GPOs.
Domain Controller (DC): Server hosting AD DS and SYSVOL.

3. GPO Architecture

A GPO has two main parts:
• Group Policy Container (GPC): Stored in Active Directory and contains version information and metadata.
• Group Policy Template (GPT): Stored in SYSVOL and contains policy files, scripts, and Administrative Template settings.

4. Where GPOs Are Stored

Active Directory: CN=Policies,CN=System,<Domain>
SYSVOL: \\domain\SYSVOL\domain\Policies
Both GPC and GPT versions must match for healthy policy processing.

5. SYSVOL Replication

Modern domains use DFS Replication (DFSR) to synchronize SYSVOL. If replication fails, GPOs may not apply correctly. Use repadmin and dfsrdiag (where available) to verify health.

6. GPO Linking

GPOs can be linked to Sites, Domains, or OUs. Best practice is to link most administrative policies to OUs instead of the domain root.

7. Security Filtering

By default, Authenticated Users receive policies. Security Filtering allows applying a GPO only to selected users or groups.

8. WMI Filtering

WMI Filters apply policies only when a computer meets specific criteria, such as operating system version, RAM, or laptop/desktop type.

9. Inheritance, Enforced and Block Inheritance

Child OUs inherit parent GPOs. 'Enforced' forces a GPO to apply even when inheritance is blocked. 'Block Inheritance' prevents inherited GPOs except those marked Enforced.

10. PowerShell Commands

Get-GPO -All
Get-GPLink
Get-GPInheritance -Target 'OU=IT,DC=contoso,DC=com'
Backup-GPO -All -Path D:\GPOBackup
Get-ADOrganizationalUnit -Filter *

11. Troubleshooting

• Verify DNS points only to Domain Controllers.
• Run gpupdate /force.
• Check gpresult /h report.html.
• Verify GPO link status.
• Review Security Filtering and WMI Filters.
• Confirm SYSVOL replication with repadmin /replsummary.
• Check Event Viewer > Microsoft > Windows > GroupPolicy.

12. Best Practices

Create dedicated OUs for departments, avoid linking all policies at the domain root, keep GPOs focused on one purpose, document changes, and back up GPOs before editing.

13. Interview Questions

1. What is the difference between GPC and GPT?
2. Where are GPOs stored?
3. What is SYSVOL?
4. Explain Security Filtering.
5. Explain WMI Filtering.
6. What is Block Inheritance?
7. What does Enforced do?
8. How do you troubleshoot a replication issue?
9. Why should DNS point only to domain controllers?
10. What tools do you use to verify GPO processing?

14. Practical Lab

1. Create an OU named Finance.
2. Create a GPO named Finance Desktop Policy.
3. Link it to the Finance OU.
4. Add a wallpaper setting.
5. Run gpupdate /force.
6. Verify the policy using gpresult /h report.html.

Architecture Summary

Component

Purpose

Forest

Highest AD boundary

Domain

Authentication and administration

OU

Logical organization and GPO linking

Domain Controller

Hosts AD DS and SYSVOL

GPC

Stores GPO metadata in AD

GPT

Stores policy files in SYSVOL

SYSVOL

Replicated policy storage

DFSR

Replicates SYSVOL between DCs

Comments

Post a Comment

Popular posts from this blog

IIS Installation and Application configuration windows swerver

-
Image
  1.      Using the Server Manager, select  2 Add roles and features . Figure 4-9 Server Manager – Adding Roles and Features Select  Role-based or feature-based installation , and then click  Next . Choose  Select a server from the server pool . 4.      Select the server you are configuring, and then click  Next . Figure 4-10 Server Manager – Select Server 5.      Expand the  Web Server  role service. Figure 4-11 Server Manager – Web Server Role Services Expand the  Web Server  options and select the following  Common HTTP Features : ·         Default Document ·         ·         HTTP Errors ·         ·         Static Content · ...
Read more

IIS Self Signed

-
Image
  Securing the server with SSL Now we want to secure the cats by adding a SSL certificate to our Server. In your IIS Manager go to your server (The top of the tree to the left)  ➜  Scroll down and double-click Server Certificates. (If your self-signed certificate is already here, jump ahead to the bindings steps) We need to import our self-signed server certificate in order to enable https communication with SSL, so click Import… Click the … and find your .pfx file, fill out the password (the -po parameter in your command batch file) and click OK Your certificate is now added Double-click the newly added cert to verify that it is trusted (Your self-signed certificates were added to the correct stores in my previous post, so again: read it if you are lost right now ;-)) So far, so good! Now we can add the https binding, the same way as before but choose https with port 443, your domain as the host name and find yourself signed certificate in the drop do...
Read more

Here’s a step-by-step guide on configuring WDS on Windows Server

-
Windows Deployment Services (WDS) is a Microsoft tool for network-based installation of Windows operating systems. It enables administrators to deploy Windows images over a network to computers without requiring physical media. Here’s a step-by-step guide on configuring WDS on Windows Server: Prerequisites: A Windows Server machine with WDS role installed. Active Directory, DNS, and DHCP set up and running on the network. An NTFS partition on the server to store images. Step 1: Install WDS Role Open Server Manager and go to Manage > Add Roles and Features . Click Next until you reach the Server Roles page. Select Windows Deployment Services and click Next . Choose WDS Deployment Server and WDS Transport Server and click Next . Complete the wizard to install the role, then restart the server if prompted. Step 2: Configure Windows Deployment Services Open WDS by navigating to Server Manager > Tools > Windows Deployment Services . In the WDS console, right-click on your se...
Read more