Active Directory Fundamentals

What is Group Policy

In this lecture, we are going to be learning about Group Policy.

Now, Group Policy is a tool that is used by Systems Administrators to quickly and easily make configuration changes to Users and Computers within Active Directory. I say easily because you can make one change in Group Policy and affect hundreds or thousands of workstations in your domain.

With Group Policy you can implement security configurations across your domain quickly and easily. You can do things like, restrict certain users from login into certain computers, allow only certain users to access certain files, give specific or all users a specific Desktop background, or even deploy software to certain computers within your domain.

Group Policy is a must-have skill if you want to be a Windows Server or Systems Administrator. It is really important that you learn how to use this tool and you’re going to learn how to use Group Policy in this section.

Now, one thing that you must keep in mind is that you cannot understand Group Policy without also understanding Active Directory Users and Computers.

Now, Group Policy works by applying GPOs or Group Policy Objects to the OU structure that you have created in Active Directory. A GPO contains separate configuration settings for both users and computers.

When a GPO is applied to an OU the settings configured in the GPO are applied to the users and the computers that are within that OU.

You can also configure the GPOs to only apply to certain objects by defining the security filtering. The most common default choice is the Authenticated Users group which is basically any valid user or computer object within Active Directory.

Now, GPOs are applied recursively. This means that any setting that is applied to a parent OU or towards the Domain will also apply to all Sub OUs beneath the original OU that the GPO is applied to.

Now, let’s go ahead and launch the Group Policy Management console.

Steps:

1. Open Server Manager > Tools > Group Policy Management
2. We now see our Group Policy Management console with our Forest: instructorpaul.com:

3. Expand the Forest, Domains, and our domain name along with the policies:

The Domains folder contains all the domains that are underneath our Forest.

The Sites folder contains all of our sites that we may have configured through Active Directory Sites and Services. This is configured when you have servers in different locations like a different building, city or even a different country.

Group Policy Modeling and Group Policy Results are both tools that can be used to troubleshoot and Group Policy issues that may arise while you are working with Group Policy Objects.

4. The default Domain Policy is shown as a Link. Click Ok. This GPO comes by default. It applies downwards, so anything under it within the tree.

5. The Group Policy Object folder, shows all the policies, if enabled or not.

6. The linked option (Little arrow) shows that this GPO is linked from the Group Policy Objects.

7. WMI filters give you rules where and how a GPO can be deployed, for example only Windows 7.

8. Starter GPO is if you would like to distribute to other environments.

Now we have covered the basics of what Group Policy is, how to open the management console and a brief overview of what it is inside the console.