Chapter 3 – Group Policy Processing (LSDOU)

-

 Windows Server Group Policy (GPO) Master Handbook

Chapter 3 – Group Policy Processing (LSDOU)

Learning Objectives

Understand how Windows processes Group Policy, the LSDOU order, loopback processing, policy refresh, precedence, and troubleshooting.

1. What is Group Policy Processing?

When a computer starts and a user signs in, Windows reads applicable GPOs from Active Directory and SYSVOL. The client-side extensions process settings in a defined order.

2. LSDOU Order

Policies are processed in this order:
1. Local GPO
2. Site GPO
3. Domain GPO
4. Organizational Unit GPO
If multiple nested OUs exist, parent OU is processed before child OU. The last applied setting normally wins.

3. Computer Startup Processing

Computer Configuration is applied during boot before user logon. Examples: BitLocker, Windows Defender, Firewall, Services, Startup Scripts.

4. User Logon Processing

User Configuration is applied after authentication. Examples: Desktop wallpaper, mapped drives, printers, folder redirection, Start menu restrictions.

5. Foreground vs Background Processing

Foreground processing occurs during startup and logon. Background processing occurs every 90 minutes (+ random offset up to 30 minutes) on workstations and every 5 minutes on domain controllers.

6. Synchronous vs Asynchronous

Synchronous waits for policy processing before allowing logon. Asynchronous allows users to sign in while policies continue processing in the background.

7. Policy Precedence

If two GPOs configure the same setting, the GPO processed last takes precedence unless No Override (Enforced) changes the behavior.

8. Loopback Processing

Loopback allows User Configuration to be based on the computer's OU rather than the user's OU. Modes:
• Merge
• Replace
Common for RDS, kiosks, classrooms and shared computers.

9. Security Filtering

Only users/computers with Read and Apply Group Policy permissions receive the GPO.

10. WMI Filtering

Use WMI filters to target policies based on OS version, hardware, memory or other properties. Use sparingly because complex filters can slow processing.

11. Slow Link Detection

Windows can skip some policy extensions when a slow network link is detected. Configure this behavior through Administrative Templates.

12. Useful Commands

gpupdate /force
gpresult /r
gpresult /h C:\Temp\GPO.html
rsop.msc
Get-GPO -All
Get-GPInheritance -Target 'OU=IT,DC=contoso,DC=com'

13. Troubleshooting

• Verify the object is in the correct OU.
• Confirm the GPO is linked and enabled.
• Check Security Filtering.
• Check WMI Filter results.
• Verify SYSVOL replication.
• Review Event Viewer > Microsoft > Windows > GroupPolicy.
• Use gpresult /h to identify winning GPOs.
• Verify DNS points only to domain controllers.

14. Best Practices

Keep GPOs small and focused. Avoid unnecessary Enforced policies. Test in a pilot OU. Document changes. Back up GPOs before modification.

15. Interview Questions

1. Explain LSDOU.
2. Which policy wins when two GPOs conflict?
3. What is Loopback Processing?
4. Difference between Merge and Replace?
5. What is background refresh?
6. How do you identify which GPO applied a setting?
7. What is a Client-Side Extension?
8. Why use WMI Filtering?

16. Practical Lab

Create parent and child OUs. Link different wallpaper GPOs to each OU. Move a test computer and user between OUs, run gpupdate /force, then compare results with gpresult /h.

Processing Flow

Stage

Description

Computer Startup

Reads Computer Configuration

Local GPO

Processed first

Site

Applied if configured

Domain

Domain-level policies

Parent OU

Parent organizational unit

Child OU

Last OU processed; usually highest precedence

User Logon

Processes User Configuration

Background Refresh

Every 90 ±30 minutes (clients), 5 minutes (DCs)

Comments

Post a Comment

Popular posts from this blog

IIS Installation and Application configuration windows swerver

-
Image
  1.      Using the Server Manager, select  2 Add roles and features . Figure 4-9 Server Manager – Adding Roles and Features Select  Role-based or feature-based installation , and then click  Next . Choose  Select a server from the server pool . 4.      Select the server you are configuring, and then click  Next . Figure 4-10 Server Manager – Select Server 5.      Expand the  Web Server  role service. Figure 4-11 Server Manager – Web Server Role Services Expand the  Web Server  options and select the following  Common HTTP Features : ·         Default Document ·         ·         HTTP Errors ·         ·         Static Content · ...
Read more

IIS Self Signed

-
Image
  Securing the server with SSL Now we want to secure the cats by adding a SSL certificate to our Server. In your IIS Manager go to your server (The top of the tree to the left)  ➜  Scroll down and double-click Server Certificates. (If your self-signed certificate is already here, jump ahead to the bindings steps) We need to import our self-signed server certificate in order to enable https communication with SSL, so click Import… Click the … and find your .pfx file, fill out the password (the -po parameter in your command batch file) and click OK Your certificate is now added Double-click the newly added cert to verify that it is trusted (Your self-signed certificates were added to the correct stores in my previous post, so again: read it if you are lost right now ;-)) So far, so good! Now we can add the https binding, the same way as before but choose https with port 443, your domain as the host name and find yourself signed certificate in the drop do...
Read more

Here’s a step-by-step guide on configuring WDS on Windows Server

-
Windows Deployment Services (WDS) is a Microsoft tool for network-based installation of Windows operating systems. It enables administrators to deploy Windows images over a network to computers without requiring physical media. Here’s a step-by-step guide on configuring WDS on Windows Server: Prerequisites: A Windows Server machine with WDS role installed. Active Directory, DNS, and DHCP set up and running on the network. An NTFS partition on the server to store images. Step 1: Install WDS Role Open Server Manager and go to Manage > Add Roles and Features . Click Next until you reach the Server Roles page. Select Windows Deployment Services and click Next . Choose WDS Deployment Server and WDS Transport Server and click Next . Complete the wizard to install the role, then restart the server if prompted. Step 2: Configure Windows Deployment Services Open WDS by navigating to Server Manager > Tools > Windows Deployment Services . In the WDS console, right-click on your se...
Read more