Group Policy

Group Policy applies settings to domain users and computers from Group Policy Objects (GPOs) linked to sites, domains and OUs. This sheet covers refreshing and reporting on policy, the GroupPolicy PowerShell module, the ADMX central store and troubleshooting. See Active Directory for the directory itself, Windows Networking for DNS and connectivity problems that break policy, and Windows Updates for update policy.

Documentation: Group Policy overview, GroupPolicy module

How Policy Applies #

• Order (LSDOU): Local, Site, Domain, OU (nested OUs applied parent to child). The last applied wins on conflict.
• Computer settings apply at startup, user settings at logon, then both refresh in the background (default every 90 minutes with a random 0 to 30 minute offset; domain controllers every 5 minutes).
• Enforced links cannot be overridden by lower levels. Block Inheritance on an OU stops non-enforced GPOs from above.
• Security filtering (Authenticated Users by default) decides who the GPO applies to. The account must also have Read permission, so keep Read for Authenticated Users or Domain Computers when you narrow the apply list.
• WMI filters limit a GPO by a WMI query (for example an OS version).
• Loopback processing applies the computer’s user settings regardless of who logs on (kiosks, RDS hosts).

Refresh and Report #

Run gpresult from an elevated prompt to include computer settings. Without elevation the computer section is empty.

GroupPolicy PowerShell Module #

Install with RSAT: Add-WindowsCapability -Online -Name Rsat.GroupPolicy.Management.Tools~~~~0.0.1.0 (Windows 10/11) or Install-WindowsFeature GPMC (Server).

Unlinked GPOs are easy to find: Get-GPO -All | Where-Object { ($_ | Get-GPOReport -ReportType Xml) -notmatch '<LinksTo>' }.

GPMC and Related Consoles #

ADMX Central Store #

ADMX files define the settings you see in the editor. By default each admin PC reads its own local copy, so different machines show different settings. A central store on SYSVOL gives every admin the same templates.

Create or update it by copying the templates from a current Windows build or the downloaded ADMX package:

$dom = $env:USERDNSDOMAIN
$store = "\\$dom\SYSVOL\$dom\Policies\PolicyDefinitions"
New-Item -ItemType Directory -Path $store -Force | Out-Null
Copy-Item "C:\Windows\PolicyDefinitions\*" -Destination $store -Recurse -Force

• Keep the PolicyDefinitions folder and the en-US (or your language) subfolder together.
• Download templates for third parties (Microsoft Edge, Office, Chrome, LAPS in the OS) and drop their .admx and .adml files in.
• Update the store whenever you introduce a newer Windows version.
• Check SYSVOL replication is healthy first (dcdiag /test:netlogons, repadmin /replsummary; see Active Directory).

Troubleshooting #

Useful event logs and commands:

Get-WinEvent -LogName "Microsoft-Windows-GroupPolicy/Operational" -MaxEvents 30 |
  Select TimeCreated, Id, LevelDisplayName, Message
gpresult /h "$env:TEMP\gp.html" /f; Start-Process "$env:TEMP\gp.html"

The Operational event log and gpresult are usually enough. See Windows Troubleshooting for more event log queries, and Windows DNS Server for DNS records that machines need to find a DC.

Good Practice #

• One purpose per GPO and descriptive names; avoid editing the Default Domain Policy except for password, lockout and Kerberos settings.
• Disable the unused half (user or computer configuration) of a GPO to speed processing.
• Test in a pilot OU before wide linking; use security filtering or WMI filters sparingly.
• Back up with Backup-GPO -All before changes, and document each GPO’s comment field.
• Link at OU level where possible, not the domain root.
• Do not store passwords in Group Policy Preferences (old cpassword values are trivially decrypted).

Not Verified #

Commands were written from the Microsoft documentation and not executed against a domain. Event IDs and default refresh intervals are from documentation and may differ by Windows version.