What is Group Policy?

Group Policy manages permissions and settings in bulk for computers and signed-in users. Collections of settings, called Group Policy Objects (GPOs), change specific computer or user behaviours. Linking GPOs to organisational units (OUs) in AD applies them only to selected computers or users. Changing one GPO can therefore manage potentially thousands of computers or users.

Group Policy

a tool for managing permissions and settings in bulk for computers and signed-in users
Used for:

• applying company standards (hiding Control Panel, network printers, running scripts)
• applying security (folder permissions, password complexity, groups permitted to log on locally)
• bulk application installation (Office, Adobe Reader, etc.)

Group Policy Object “GPO”

a collection of multiple settings

• a Group Policy component
• divided into computer settings and user settings
• linked to organisational units (OUs) in AD
• one GPO can be linked to multiple OUs

Policies

• policies are divided into local and domain policies

Local:

Every computer since Windows 2000 has local Group Policy affecting the computer and its signed-in users. If a computer is not domain-joined, only local policies apply.

For example, if you create a user with restricted permissions, local policy defines that user's behaviour.

Local policies are stored in the hidden directory %systemroot%\system32\GroupPolicy

Domain:

Domain policies apply only to domain-member computers and users. Two default domain policies are created when AD is installed

GPO structure

Group Policy contains over 2,400 settings affecting computers and signed-in users. Not all settings apply to all operating systems (2000, XP, Vista, 7): each new OS introduces hundreds of settings applicable only to that system. Windows 2000 simply ignores settings intended for Windows XP SP2.

We recommend reading each setting's description, which identifies the systems to which it applies

GPO divisions

Group Policy has two parts: computer configuration (Computer configuration) and user configuration (User configuration)

When creating a GPO, you can disable either the user or computer section to reduce its overall size

each part has three further sections:

• software settings (Software settings)
• Windows settings (Windows settings)
• administrative templates (Administrative templates)

How Group Policy (GPOs) is applied

Group Policy is applied separately for computer configuration and user configuration, both by the Group Policy Client.

Applying computer configuration

• at computer startup and otherwise every 90 minutes
• Startup scripts are applied

Applying computer configuration every 90 minutes began with Windows Vista. Windows XP applied it only at startup.

Applying user configuration

• at user logon and otherwise every 90 minutes
• Logon scripts are applied

The command gpupdate /force can reapply all policies

How GPOs are processed at computer startup:

1. The computer finds a DC and logs on, just like a user. Successful logon requires these ports: UDP 53 (DNS), UDP and TCP 389 (LDAP), TCP 135 (RPC Portmapper), UDP 88 (Kerbedos)
2. The computer uses ICMP packets to detect a slow link (Slow Link Detection)
3. Using LDAP, it identifies GPOs linked to the OU, domain and site, building a list of all applicable GPOs
4. Using LDAP, the computer queries the filters for all identified GPOs and requests attributes such as the GPT (Group Policy Templates) path, GPC (Group Policy Configuration) version number, gpCMachineExtensionNames and gpCUserExtensionnames
5. The computer connects to SYSVOL over SMB (TCP port 445) and reads GPT.INI for each applicable GPO.
6. The Group Policy process compares the GPO version with its locally stored version (HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\History)
7. Unchanged GPO versions are skipped. A GPO can be configured to apply every time even without changes. This can also be forced from CMD using gpupdate /force
8. The CSE (Client Side Extension) checks access rights to each applicable GPO. GPOs without sufficient permissions are removed from the list. Enforced GPOs are moved to the end at this stage, so their settings always win any conflict.
9. The CSE processes each GPO
10. After processing each GPO, the CSE logs RSoP (Result of Policy) through WMI to the computer's CIMOM database.
11. After logon, the process repeats for user settings

Exceptions to policy application

Group Policy can detect connection speed. On a slow link (less than 500 kilobits), and depending on other factors, some policies may not apply.

Templates and ADM/ADMX files

The extensive settings and graphical Group Policy display in GPM led to templates containing predefined GPO properties or supporting creation of new GPOs. Since Windows Vista and Server 2008, there are two formats: the older ADM and newer ADMX.

ADM

By default, new GPOs use two ADM files: Inetres.adm (Internet Explorer settings) and System.adm (Windows OS settings). When a policy is created, these files are copied from %SystemRoot%\Infto the relevant GPO folder in SYSVOL. Each new GPO consumes about 3.5 MB of SYSVOL space. In large organisations with many GPOs, this can significantly burden SYSVOL replication.

ADMX

Windows Vista and Windows Server 2008 introduce a new policy display format. Policies use the XML-based ADMX format, replacing ADM files. Vista and Server 2008 still recognise ADM files. ADMX files are stored in %systemroot%\PolicyDefinitions and are not copied to SYSVOL when a new policy is created

ADMX advantages:

• language-neutral
• not stored in SYSVOL
• the XML-based ADMX format can be extended at any time

What is the Central Store?

The "Central Store" must be created manually in SYSVOL so it replicates to all DCs. It stores ADMX and ADML files. Any ADMX template changes then automatically replicate to all DCs.

Group Policy Processing

As mentioned, policies are local or domain-based. More specifically, they are divided into:

1. Local Group Policy
2. Site Level GPOs
3. Domain Level GPOs
4. Organizational Unit GPOs
5. Child Organizational Unit GPOs

Policies apply from level 1 to level 5. If level 1 sets PROXY Enable and level 4 sets PROXY Disable, level 4 wins and the computer's proxy remains disabled

Controlling Group Policy application

Application can be controlled at individual GPO level. Each policy can use:

What is Loopback Processing and how does it work?

Loopback Processing is a Computer-level GPO setting. When enabled, all User-level settings also apply even though the policy is linked to the Computers container. This is used, for example, on terminal servers requiring user security to be applied at computer level.

It has two modes:

• Merge mode
• Replace mode

Delegating Group Policy administration permissions