754318 - Let's talk about GPO!

Status: RESOLVED INVALID

(Infrastructure & Operations :: RelOps: General, task)

Description

[Matthew Larrain[:MaRu]]

Group Policy and Group Policy Objects more commonly referred to as GP/GPO is a feature of the Microsoft Windows NT family of operating systems that control the working environment of user accounts and computer accounts. Group Policy provides the centralized management and configuration of operating systems, applications, and users' settings in an Active Directory environment.

By default, Microsoft Windows refreshes its policy settings every 90 minutes with a random 30 minutes offset. On Domain controllers, Microsoft Windows does so every five minutes. During the refresh, it discovers, fetches and applies all GPOs that apply to the machine and logged on user. Some settings, such as automated software installation, drive mappings, startup scripts or logon scripts are only applied during startup or user logon. Since Windows XP, a refresh of the group policy can be manually initiated by the user using the gpupdate command from a command prompt.

Group Policy Objects are processed in the following order:

    Local - Any settings in the computer's local policy. Prior to Windows Vista, there was only one local group policy stored per computer. Windows Visa and later Windows versions allow individual group policies per user accounts.
    Site - Any Group Policies associated with the Active Directory site in which the computer resides. (An Active Directory site is a logical grouping of computers that is meant to facilitate management of computers based on their physical proximity.) If multiple policies are linked to a site, they are processed in the order set by the administrator.
    Domain - Any Group Policies associated with the Windows domain in which the computer resides. If multiple policies are linked to a domain, they are processed in the order set by the administrator.
    Organizational Unit - Group policies assigned to the Active Directory organizational unit (OU) in which the computer or user are placed. (OUs are logical units that help organizing and managing a group of users, computers or other Active Directory objects.) If multiple policies are linked to an OU, they are processed in the order set by the administrator.