Chapter_01_Group_Policy_Introduction

-

 

Windows Server Group Policy (GPO) Master Handbook

Chapter 1 - Introduction to Group Policy
Enterprise Edition

1. What is Group Policy?

Group Policy is a Windows feature that allows administrators to centrally manage user and computer settings in an Active Directory environment. Instead of configuring each computer manually, administrators create a Group Policy Object (GPO) and apply it to domains or organizational units.

2. Why Use Group Policy?

Standardizes security settings, deploys software, maps drives, installs printers, enforces password policies, configures Windows Update, manages Microsoft Defender, controls USB devices, and reduces administrative effort.

3. Local GPO vs Domain GPO

Local GPO affects only one computer. Domain GPO is stored in Active Directory and SYSVOL, and applies to users and computers based on scope and inheritance.

4. GPO Processing (LSDOU)

Policies are processed in this order: Local → Site → Domain → Organizational Unit. Later policies can override earlier settings unless blocked or enforced.

5. Computer vs User Configuration

Computer Configuration applies during computer startup regardless of who signs in. User Configuration applies when a user signs in.

6. SYSVOL and NETLOGON

SYSVOL stores Group Policy templates and scripts replicated among domain controllers. NETLOGON stores logon scripts and shared resources.

7. Common Administrative Tools

gpmc.msc, gpedit.msc, rsop.msc, gpupdate, gpresult, Event Viewer, Active Directory Users and Computers.

8. PowerShell Commands

Get-GPO -All
Get-GPInheritance -Target "OU=IT,DC=contoso,DC=com"
New-GPO -Name "Desktop Policy"
Backup-GPO -All -Path D:\GPOBackup
Restore-GPO -Name "Desktop Policy"
gpupdate /force
gpresult /h C:\Temp\gporeport.html

9. Troubleshooting

• Run gpupdate /force.
• Generate gpresult /h report.html.
• Verify the computer and user are in the correct OU.
• Check Security Filtering and WMI Filters.
• Verify SYSVOL replication (DFSR).
• Review Event Viewer under Applications and Services Logs > Microsoft > Windows > GroupPolicy.
• Confirm DNS points to domain controllers only.
• Check replication using repadmin /replsummary.

10. Best Practices

• Create separate GPOs for security and desktop settings.
• Test in a lab OU before production.
• Use descriptive GPO names.
• Back up GPOs regularly.
• Avoid editing Default Domain Policy except for account policies.
• Minimize Block Inheritance and Enforced usage.

11. Interview Questions

Q1. What is Group Policy?
Q2. Explain LSDOU.
Q3. Difference between Computer and User Configuration?
Q4. What are GPC and GPT?
Q5. How do you troubleshoot a GPO that is not applying?
Q6. What is loopback processing?
Q7. What is SYSVOL?
Q8. What is Security Filtering?
Q9. What is a WMI Filter?
Q10. Which tools are used to troubleshoot GPO?

12. Practical Lab

1. Create an OU named IT.
2. Create a GPO named IT Desktop Policy.
3. Configure a desktop wallpaper.
4. Link the GPO to the IT OU.
5. Run gpupdate /force.
6. Verify with gpresult /h report.html.

Useful Group Policy Paths

Policy

Path

Password Policy

Computer Configuration > Windows Settings > Security Settings > Account Policies

Windows Update

Computer Configuration > Administrative Templates > Windows Components > Windows Update

Desktop Wallpaper

User Configuration > Administrative Templates > Desktop > Desktop Wallpaper

Drive Mapping

User Configuration > Preferences > Windows Settings > Drive Maps

Folder Redirection

User Configuration > Windows Settings > Folder Redirection

BitLocker

Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption

LAPS

Computer Configuration > Administrative Templates > System > LAPS

 

Comments

Post a Comment

Popular posts from this blog

IIS Installation and Application configuration windows swerver

-
Image
  1.      Using the Server Manager, select  2 Add roles and features . Figure 4-9 Server Manager – Adding Roles and Features Select  Role-based or feature-based installation , and then click  Next . Choose  Select a server from the server pool . 4.      Select the server you are configuring, and then click  Next . Figure 4-10 Server Manager – Select Server 5.      Expand the  Web Server  role service. Figure 4-11 Server Manager – Web Server Role Services Expand the  Web Server  options and select the following  Common HTTP Features : ·         Default Document ·         ·         HTTP Errors ·         ·         Static Content · ...
Read more

IIS Self Signed

-
Image
  Securing the server with SSL Now we want to secure the cats by adding a SSL certificate to our Server. In your IIS Manager go to your server (The top of the tree to the left)  ➜  Scroll down and double-click Server Certificates. (If your self-signed certificate is already here, jump ahead to the bindings steps) We need to import our self-signed server certificate in order to enable https communication with SSL, so click Import… Click the … and find your .pfx file, fill out the password (the -po parameter in your command batch file) and click OK Your certificate is now added Double-click the newly added cert to verify that it is trusted (Your self-signed certificates were added to the correct stores in my previous post, so again: read it if you are lost right now ;-)) So far, so good! Now we can add the https binding, the same way as before but choose https with port 443, your domain as the host name and find yourself signed certificate in the drop do...
Read more

Here’s a step-by-step guide on configuring WDS on Windows Server

-
Windows Deployment Services (WDS) is a Microsoft tool for network-based installation of Windows operating systems. It enables administrators to deploy Windows images over a network to computers without requiring physical media. Here’s a step-by-step guide on configuring WDS on Windows Server: Prerequisites: A Windows Server machine with WDS role installed. Active Directory, DNS, and DHCP set up and running on the network. An NTFS partition on the server to store images. Step 1: Install WDS Role Open Server Manager and go to Manage > Add Roles and Features . Click Next until you reach the Server Roles page. Select Windows Deployment Services and click Next . Choose WDS Deployment Server and WDS Transport Server and click Next . Complete the wizard to install the role, then restart the server if prompted. Step 2: Configure Windows Deployment Services Open WDS by navigating to Server Manager > Tools > Windows Deployment Services . In the WDS console, right-click on your se...
Read more