howITwork

Group Policy basics: how GPOs apply, and why they don’t

Group Policy lets you set something once, such as a password rule, a mapped drive or a locked-down USB port, and have every matching PC and user in the domain pick it up automatically. This guide explains how it works, the order it applies in, and how to find out why a policy did or didn’t apply.

What a Group Policy Object is

A Group Policy Object (GPO) is a named collection of settings stored in Active Directory. On its own it does nothing; it takes effect when you link it to a site, the domain, or an organisational unit (OU). Every computer or user inside that container then receives it.

You manage GPOs with the Group Policy Management console (gpmc.msc), included with RSAT on Windows 10/11 and on domain controllers.

Computer settings vs user settings

  • Computer Configuration applies to the computer accounts in the linked OU, at start-up and in the background, whoever signs in. Examples: Windows Update settings, firewall rules, blocking USB storage.
  • User Configuration applies to the user accounts in the linked OU, at sign-in, on whichever PC they use. Examples: mapped drives, the desktop wallpaper, hiding Control Panel.

A common mistake is putting user settings in a GPO linked to an OU that contains only computers. Nothing happens, because no users are in that OU. (Loopback processing changes this for kiosks and terminal servers, but that’s an advanced case.)

The order policies apply in: L, S, D, OU

  1. Local policy on the PC itself
  2. Site
  3. Domain
  4. OU, from the top-level OU down to the OU that holds the object

Policies are applied in that order and the last one wins when two set the same thing, so an OU policy overrides a domain policy. Two switches change this:

  • Enforced (on a link): this GPO wins over anything lower down, and can’t be blocked.
  • Block inheritance (on an OU): ignore GPOs linked higher up, except enforced ones.

Use both sparingly; they make troubleshooting much harder.

Who gets it: security filtering

By default a linked GPO applies to Authenticated Users. To target only some users or computers, remove that entry under Security Filtering and add a group instead. Keep Authenticated Users (or Domain Computers) with Read permission on the Delegation tab, or the policy can’t be read and silently won’t apply.

Three everyday examples

  • Map a drive for Finance: User Configuration → Preferences → Windows Settings → Drive Maps. Add \fileserverfinance as drive F:, and link the GPO to the Finance users’ OU.
  • Block USB storage: Computer Configuration → Policies → Administrative Templates → System → Removable Storage Access → “All Removable Storage classes: Deny all access”. Link it to the computers’ OU.
  • Password rules: set these in the Default Domain Policy (linked to the domain). Password policy for domain accounts only works at domain level; for different rules per group, use fine-grained password policies.

Create and link a GPO with PowerShell

# Create a GPO and link it to an OU
New-GPO -Name "Finance - Map F drive" |
  New-GPLink -Target "OU=Finance,OU=Users,OU=Lahore,DC=howitwork,DC=local"

# List all GPOs, and back them all up (do this before big changes)
Get-GPO -All | Select-Object DisplayName, ModificationTime
Backup-GPO -All -Path "C:GPO-Backups"

When will it apply?

Computers and users refresh policy in the background every 90 minutes, plus a random 0 to 30 minutes. Some settings (software installation, folder redirection) only apply at start-up or sign-in. To apply now:

gpupdate /force

Troubleshooting: why didn’t it apply?

# Which GPOs applied to this computer and user, and which were filtered out
gpresult /r

# A full HTML report (run as the affected user)
gpresult /h C:Tempgp-report.html

Check, in order:

  1. Is the object in the OU you linked? Users and computers left in the default Users and Computers containers don’t get OU policies; those are containers, not OUs, and can’t have GPOs linked to them.
  2. Right half of the GPO? User settings for users, computer settings for computers.
  3. Filtered out? gpresult lists “denied” GPOs and the reason (security filtering, WMI filter, empty).
  4. Overridden? A GPO further down the L-S-D-OU order may set the opposite value.
  5. Can the PC reach a domain controller? Group Policy is downloaded from the domain controllers’ SYSVOL share, so DNS problems break it too.

Good habits

  • One purpose per GPO, with a clear name (“Finance – Map F drive”, not “New GPO 7”).
  • Test on a test OU with one PC before linking to everyone.
  • Don’t edit the Default Domain Policy for anything except account policies.
  • Back up GPOs before changes, and write a short comment on each GPO saying why it exists.

More IT guides · howITwork on YouTube