Chapter 6 – Group Policy Management Console (GPMC)

-

 Windows Server Group Policy (GPO) Master Handbook

Chapter 6 – Group Policy Management Console (GPMC)

Learning Objectives

Learn to manage Group Policy using the Group Policy Management Console (GPMC), including creating, linking, backing up, restoring, delegating, and troubleshooting GPOs.

1. What is GPMC?

Group Policy Management Console (gpmc.msc) is the primary administrative tool used to create, edit, link, back up, restore, import, copy, delegate, and troubleshoot Group Policy Objects in an Active Directory domain.

2. Opening GPMC

Server Manager → Tools → Group Policy Management, or press Win+R and run gpmc.msc.

3. Main Components

Forest, Domains, Sites, Organizational Units, Group Policy Objects, Starter GPOs, WMI Filters, Group Policy Modeling, Group Policy Results.

4. Common Administrative Tasks

Create a new GPO, link it to an OU, edit settings, enable/disable links, enforce policies, back up GPOs, restore deleted GPOs, import settings, copy GPOs between domains, delegate GPO management.

5. Backup & Restore

Back up GPOs before major changes. Store backups securely and test restoration in a lab before production.

6. Group Policy Modeling

Simulates policy application for a user/computer without affecting production. Useful for testing inheritance and security filtering.

7. Group Policy Results

Collects Resultant Set of Policy (RSoP) information from a target computer to determine which GPOs were applied and why.

8. Delegation

Delegate permissions such as Read, Edit Settings, Edit/Delete/Modify Security to helpdesk or infrastructure teams without granting Domain Admin rights.

9. Troubleshooting

Verify GPO links, inheritance, Security Filtering, WMI Filters, SYSVOL replication, DNS configuration, and use gpresult /h plus Event Viewer to identify policy failures.

10. PowerShell

Get-GPO -All
New-GPO -Name 'Desktop Policy'
Backup-GPO -All -Path D:\GPOBackup
Restore-GPO -Name 'Desktop Policy'
Get-GPInheritance -Target 'OU=IT,DC=contoso,DC=com'

11. Best Practices

Use descriptive names, separate user and computer settings, test changes in a pilot OU, back up regularly, document every production change, and avoid modifying Default Domain Policy except account policies.

12. Interview Questions

Explain GPMC. Difference between Group Policy Modeling and Results? How do you back up a GPO? What is Starter GPO? How do you troubleshoot a GPO that does not apply?

13. Practical Lab

Create a new GPO called 'IT Desktop Policy', link it to the IT OU, configure a wallpaper, run gpupdate /force on a client, and verify using Group Policy Results and gpresult /h.

Useful Microsoft Documentation

Group Policy Overview

Group Policy Management

Administrative Templates

Windows Server Documentation

PowerShell GroupPolicy Module

Administrator Checklist

Task

Status

Backup GPO

☐

Document change

☐

Pilot OU tested

☐

gpupdate completed

☐

gpresult verified

☐

SYSVOL healthy

☐

DFSR healthy

☐

Rollback plan prepared

☐

Comments

Post a Comment

Popular posts from this blog

IIS Installation and Application configuration windows swerver

-
Image
  1.      Using the Server Manager, select  2 Add roles and features . Figure 4-9 Server Manager – Adding Roles and Features Select  Role-based or feature-based installation , and then click  Next . Choose  Select a server from the server pool . 4.      Select the server you are configuring, and then click  Next . Figure 4-10 Server Manager – Select Server 5.      Expand the  Web Server  role service. Figure 4-11 Server Manager – Web Server Role Services Expand the  Web Server  options and select the following  Common HTTP Features : ·         Default Document ·         ·         HTTP Errors ·         ·         Static Content · ...
Read more

IIS Self Signed

-
Image
  Securing the server with SSL Now we want to secure the cats by adding a SSL certificate to our Server. In your IIS Manager go to your server (The top of the tree to the left)  ➜  Scroll down and double-click Server Certificates. (If your self-signed certificate is already here, jump ahead to the bindings steps) We need to import our self-signed server certificate in order to enable https communication with SSL, so click Import… Click the … and find your .pfx file, fill out the password (the -po parameter in your command batch file) and click OK Your certificate is now added Double-click the newly added cert to verify that it is trusted (Your self-signed certificates were added to the correct stores in my previous post, so again: read it if you are lost right now ;-)) So far, so good! Now we can add the https binding, the same way as before but choose https with port 443, your domain as the host name and find yourself signed certificate in the drop do...
Read more

Here’s a step-by-step guide on configuring WDS on Windows Server

-
Windows Deployment Services (WDS) is a Microsoft tool for network-based installation of Windows operating systems. It enables administrators to deploy Windows images over a network to computers without requiring physical media. Here’s a step-by-step guide on configuring WDS on Windows Server: Prerequisites: A Windows Server machine with WDS role installed. Active Directory, DNS, and DHCP set up and running on the network. An NTFS partition on the server to store images. Step 1: Install WDS Role Open Server Manager and go to Manage > Add Roles and Features . Click Next until you reach the Server Roles page. Select Windows Deployment Services and click Next . Choose WDS Deployment Server and WDS Transport Server and click Next . Complete the wizard to install the role, then restart the server if prompted. Step 2: Configure Windows Deployment Services Open WDS by navigating to Server Manager > Tools > Windows Deployment Services . In the WDS console, right-click on your se...
Read more