Group Policy is a feature of the Microsoft
Windows NT
Windows NT is a proprietary graphical operating system
An operating system (OS) is system software that manages computer hardware, software resources, and provides common services for computer programs.
Time-sharing operating systems sc ...
family of
operating system
An operating system (OS) is system software that manages computer hardware, software resources, and provides common services for computer programs.
Time-sharing operating systems schedule tasks for efficient use of the system and may also in ...
s (including Windows 7, Windows 8.1, Windows 10, Windows 11, and Windows Server 2003+) that controls the working environment of user accounts and computer accounts. Group Policy provides centralized management and configuration of operating systems, applications, and users' settings in an
Active Directory
Active Directory (AD) is a directory service developed by Microsoft for Windows domain networks. It is included in most Windows Server operating systems as a set of processes and services. Initially, Active Directory was used only for centralize ...
environment. A set of Group Policy configurations is called a Group Policy Object (GPO). A version of Group Policy called Local Group Policy (LGPO or LocalGPO) allows Group Policy Object management without Active Directory on standalone computers.
Active Directory servers disseminate group policies by listing them in their
LDAP
The Lightweight Directory Access Protocol (LDAP ) is an open, vendor-neutral, industry standard application protocol for accessing and maintaining distributed directory information services over an Internet Protocol (IP) network. Directory servi ...
directory under objects of class
groupPolicyContainer
. These refer to fileserver paths (attribute
gPCFileSysPath
) that store the actual group policy objects, typically in an
SMB share \\
domain.com\
SYSVOL shared by the Active Directory server. If a group policy has registry settings, the associated file share will have a file
registry.pol
with the registry settings that the client needs to apply.
The Policy Editor (gpedit.msc) is not provided on Home versions of Windows XP/Vista/7/8/8.1/10/11.
Operation
Group Policies, in part, control what users can and cannot do on a computer system. For example, a Group Policy can be used to enforce a password complexity policy that prevents users from choosing an overly simple password. Other examples include: allowing or preventing unidentified users from remote computers to connect to a
network share
In computing, a shared resource, or network share, is a computer resource made available from one host to other hosts on a computer network.
It is a device or piece of information on a computer that can be remotely accessed from another comput ...
, or to block/restrict access to certain folders. A set of such configurations is called a Group Policy Object (GPO).
As part of Microsoft's ''IntelliMirror'' technologies, Group Policy aims to reduce the cost of supporting users. IntelliMirror technologies relate to the management of disconnected machines or roaming users and include ''
roaming user profiles
A roaming user profile is a file synchronization concept in the Windows NT family of operating systems that allows users with a computer joined to a Windows domain to log on to any computer on the same domain and access their documents and have ...
'', ''
folder redirection In computing, and specifically in the context of Microsoft Windows operating systems, Microsoft refers to Folder Redirection when automatically re-routing I/O to/from standard folders (directories) to use storage elsewhere on a network.
It is of ...
'', and ''
offline files
Windows Vista introduced a number of new I/O functions to the Microsoft Windows line of operating systems. They are intended to shorten the time taken to boot the system, improve the responsiveness of the system, and improve the reliability of dat ...
''.
Enforcement
To accomplish the goal of central management of a group of computers, machines should receive and enforce GPOs. A GPO that resides on a single machine only applies to that computer. To apply a GPO to a group of computers, Group Policy relies on
Active Directory
Active Directory (AD) is a directory service developed by Microsoft for Windows domain networks. It is included in most Windows Server operating systems as a set of processes and services. Initially, Active Directory was used only for centralize ...
(or on third-party products like
ZENworks Desktop Management
ZENworks, a suite of software products developed and maintained by Micro Focus International for computer systems management, aims to manage the entire life cycle of servers, of desktop PCs (Windows, Linux or Mac), of laptops, and of handhel ...
) for distribution. Active Directory can distribute GPOs to computers which belong to a
Windows domain
A Windows domain is a form of a computer network in which all user accounts, computers, printers and other Principal (computer security), security principals, are registered with a central database located on one or more clusters of central compu ...
.
By default, Microsoft Windows refreshes its policy settings every 90 minutes with a random 30 minutes offset. On
domain controller A domain controller (DC) is a server computer that responds to security authentication requests within a computer network domain. It is a network server that is responsible for allowing host access to domain resources. It authenticates users, store ...
s, Microsoft Windows does so every five minutes. During the refresh, it discovers, fetches and applies all GPOs that apply to the machine and to logged-on users. Some settings - such as those for automated software installation, drive mappings, startup scripts or logon scripts - only apply during startup or user logon. Since
Windows XP
Windows XP is a major release of Microsoft's Windows NT operating system. It was released to manufacturing on August 24, 2001, and later to retail on October 25, 2001. It is a direct upgrade to its predecessors, Windows 2000 for high-end and ...
, users can manually initiate a refresh of the group policy by using the
gpupdate
command
Command may refer to:
Computing
* Command (computing), a statement in a computer language
* COMMAND.COM, the default operating system shell and command-line interpreter for DOS
* Command key, a modifier key on Apple Macintosh computer keyboards
* ...
from a
command prompt
Command Prompt, also known as cmd.exe or cmd, is the default command-line interpreter for the OS/2, eComStation, ArcaOS, Microsoft Windows (Windows NT family and Windows CE family), and ReactOS operating systems. On Windows CE .NET 4.2, Wind ...
.
Group Policy Objects are processed in the following order (from top to bottom):
# Local - Any settings in the computer's local policy. Prior to Windows Vista, there was only one local group policy stored per computer. Windows Vista and later Windows versions allow individual group policies per user accounts.
# Site - Any Group Policies associated with the ''
Active Directory
Active Directory (AD) is a directory service developed by Microsoft for Windows domain networks. It is included in most Windows Server operating systems as a set of processes and services. Initially, Active Directory was used only for centralize ...
site'' in which the computer resides. (An Active Directory site is a logical grouping of computers, intended to facilitate management of those computers based on their physical proximity.) If multiple policies are linked to a site, they are processed in the order set by the administrator.
# Domain - Any Group Policies associated with the
Windows domain
A Windows domain is a form of a computer network in which all user accounts, computers, printers and other Principal (computer security), security principals, are registered with a central database located on one or more clusters of central compu ...
in which the computer resides. If multiple policies are linked to a domain, they are processed in the order set by the administrator.
# Organizational Unit - Group policies assigned to the ''Active Directory organizational unit (OU)'' in which the computer or user are placed. (OUs are logical units that help organizing and managing a group of users, computers or other Active Directory objects.) If multiple policies are linked to an OU, they are processed in the order set by the administrator.
The resulting Group Policy settings applied to a given computer or user are known as the Resultant Set of Policy (RSoP). RSoP information may be displayed for both computers and users using the
gpresult
command.
Inheritance
A policy setting inside a hierarchical structure is ordinarily passed from parent to children, and from children to grandchildren, and so forth. This is termed ''inheritance''. It can be blocked or enforced to control what policies are applied at each level. If a higher level administrator (enterprise administrator) creates a policy that has inheritance blocked by a lower level administrator (domain administrator), this policy will still be processed.
Where a Group Policy Preference Settings is configured and there is also an equivalent Group Policy Setting configured, then the value of the Group Policy Setting will take precedence.
Filtering
''WMI filtering'' is the process of customizing the scope of the GPO by choosing a (WMI) filter to apply. These filters allow administrators to apply the GPO only to, for example, computers of specific models, RAM, installed software, or anything available via WMI queries.
Local Group Policy
''Local Group Policy (LGP, or LocalGPO)'' is a more basic version of Group Policy for standalone and non-domain computers, that has existed at least since
Windows XP
Windows XP is a major release of Microsoft's Windows NT operating system. It was released to manufacturing on August 24, 2001, and later to retail on October 25, 2001. It is a direct upgrade to its predecessors, Windows 2000 for high-end and ...
, and can be applied to domain computers. Prior to Windows Vista, LGP could enforce a Group Policy Object for a single local computer, but could not make policies for individual users or groups. From Windows Vista onward, LGP allow Local Group Policy management for individual users and groups as well,
and also allows backup, importing and exporting of policies between standalone machines via "GPO Packs" – group policy containers which include the files needed to import the policy to the destination machine.
Group Policy preferences
Group Policy Preferences are a way for the administrator to set policies that are not mandatory, but optional for the user or computer.
There is a set of group policy setting extensions that were previously known as PolicyMaker. Microsoft bought PolicyMaker and then integrated them with
Windows Server 2008
Windows Server 2008 is the fourth release of the Windows Server operating system produced by Microsoft as part of the Windows NT family of the operating systems. It was released to manufacturing on February 4, 2008, and generally to retail on Fe ...
. Microsoft has since released a migration tool that allows users to migrate PolicyMaker items to Group Policy Preferences.
Group Policy Preferences adds a number of new configuration items. These items also have a number of additional targeting options that can be used to granularly control the application of these setting items.
Group Policy Preferences are compatible with x86 and x64 versions of Windows XP, Windows Server 2003, and Windows Vista with the addition of the
Client Side Extensions (also known as CSE).
Client Side Extensions are now included in
Windows Server 2008
Windows Server 2008 is the fourth release of the Windows Server operating system produced by Microsoft as part of the Windows NT family of the operating systems. It was released to manufacturing on February 4, 2008, and generally to retail on Fe ...
,
Windows 7
Windows 7 is a major release of the Windows NT operating system developed by Microsoft. It was released to manufacturing on July 22, 2009, and became generally available on October 22, 2009. It is the successor to Windows Vista, released nearly ...
, and
Windows Server 2008 R2
Windows Server 2008 R2 is the fifth version of the Windows Server operating system produced by Microsoft and released as part of the Windows NT family of operating systems. It was released to manufacturing on July 22, 2009, and became General av ...
.
Group Policy Management Console
Originally, Group Policies were modified using the Group Policy Edit tool that was integrated with Active Directory Users and Computers
Microsoft Management Console
Microsoft Management Console (MMC) is a component of Microsoft Windows that provides system administrators and advanced users an interface for configuring and monitoring the system. It was first introduced in 1998 with the Option Pack for Window ...
(MMC) snap-in, but it was later split into a separate MMC snap-in called the Group Policy Management Console (GPMC). The GPMC is now a user component in
Windows Server 2008
Windows Server 2008 is the fourth release of the Windows Server operating system produced by Microsoft as part of the Windows NT family of the operating systems. It was released to manufacturing on February 4, 2008, and generally to retail on Fe ...
and
Windows Server 2008 R2
Windows Server 2008 R2 is the fifth version of the Windows Server operating system produced by Microsoft and released as part of the Windows NT family of operating systems. It was released to manufacturing on July 22, 2009, and became General av ...
and is provided as a download as part of the
Remote Server Administration Tools
Remote may refer to:
Arts, entertainment, and media
* ''Remote'' (1993 film), a 1993 movie
* ''Remote'' (2004 film), a Tamil-language action drama film
* ''Remote'' (album), a 1988 album by Hue & Cry
* Remote (band), ambient chillout band
* ...
for
Windows Vista
Windows Vista is a major release of the Windows NT operating system developed by Microsoft. It was the direct successor to Windows XP, which was released five years before, at the time being the longest time span between successive releases of ...
and
Windows 7
Windows 7 is a major release of the Windows NT operating system developed by Microsoft. It was released to manufacturing on July 22, 2009, and became generally available on October 22, 2009. It is the successor to Windows Vista, released nearly ...
.
Advanced Group Policy Management
Microsoft
Microsoft Corporation is an American multinational technology corporation producing computer software, consumer electronics, personal computers, and related services headquartered at the Microsoft Redmond campus located in Redmond, Washing ...
has also released a tool to make changes to Group Policy called Advanced Group Policy Management (a.k.a. AGPM). This tool is available for any organization that has licensed the
Microsoft Desktop Optimization Pack
Microsoft Desktop Optimization Pack (MDOP) is a suite of utilities for Microsoft Windows customers who have subscribed to Microsoft Software Assurance program. It aims at bringing easier manageability and monitoring of enterprise desktops, emerg ...
(a.k.a. MDOP). This advanced tool allows administrators to have a check in/out process for modification Group Policy Objects, track changes to Group Policy Objects, and implement approval workflows for changes to Group Policy Objects.
AGPM consists of two parts - server and client.
The server is a Windows Service that stores its Group Policy Objects in an archive located on the same computer or a network share.
The client is a snap-in to the Group Policy Management Console, and connects to the AGPM server. Configuration of the client is performed via Group Policy.
Security
Group Policy settings are enforced voluntarily by the targeted applications. In many cases, this merely consists of disabling the user interface for a particular function.
"Circumventing Group Policy as a Limited User/ref>
Windows 8 enhancements
Windows 8
Windows 8 is a major release of the Windows NT operating system developed by Microsoft. It was Software release life cycle#Release to manufacturing (RTM), released to manufacturing on August 1, 2012; it was subsequently made available for downl ...
has introduced a new feature called Group Policy Update. This feature allows an administrator to force a group policy update on all computers with accounts in a particular Organizational Unit. This creates a scheduled task on the computer which runs the
gpupdate
command within 10 minutes, adjusted by a random offset to avoid overloading the domain controller.
Group Policy Infrastructure Status was introduced, which can report when any Group Policy Objects are not replicated correctly amongst domain controllers.
Group Policy Results Report also has a new feature that times the execution of individual components when doing a Group Policy Update.
See also
*
Administrative Templates {{unreferenced, date=July 2010
Administrative Templates are a feature of Group Policy, a Microsoft technology for centralized management of machines and users in an Active Directory environment.
Administrative Templates facilitate the management of ...
*
Group Policy improvements in Windows Vista
*
Workgroup Manager
Workgroup Manager is a computer program bundled as part of OS X Server for directory-based management of users, groups and computers across a network.
This is where an admin could add, delete, and modify computer, and user accounts and groups. C ...
References
Further reading
#
#
#
#
External links
*
Group Policy Team BlogGroup Policy Settings Reference for Windows and Windows ServerForce Gpupdate
{{Windows commands
Active Directory
Windows components
Windows administration