 | Parts of this article (those related to Windows 10 issues) need to beupdated. Please help update this article to reflect recent events or newly available information.(September 2018) |
Group Policy is a feature of the MicrosoftWindows NT family ofoperating systems (including Windows 8.1, Windows 10, Windows 11) that controls the working environment of user accounts and computer accounts. Group Policy provides centralized management and configuration of operating systems, applications, and users' settings in anActive Directory environment. A set of Group Policy configurations is called aGroup Policy Object (GPO). A version of Group Policy calledLocal Group Policy (LGPO or LocalGPO) allows Group Policy Object management without Active Directory on standalone computers.[1][2]
Active Directory servers disseminate group policies by listing them in theirLDAP directory under objects of classgroupPolicyContainer. These refer to fileserver paths (attributegPCFileSysPath) that store the actual group policy objects, typically in anSMB share \\domain.com\SYSVOL shared by the Active Directory server. If a group policy hasregistry settings, the associated file share will have a fileregistry.pol with the registry settings that the client needs to apply.[3]
The Policy Editor (gpedit.msc) is not provided on Home (& Starter) editions of Windows.
Group Policies, in part, control what users can and cannot do on a computer system. For example, a Group Policy can be used to enforce a password complexity policy that prevents users from choosing an overly simple password. Other examples include: allowing or preventing unidentified users from remote computers to connect to anetwork share, or to block/restrict access to certain folders. A set of such configurations is called a Group Policy Object (GPO).
As part of Microsoft'sIntelliMirror technologies, Group Policy aims to reduce the cost of supporting users. IntelliMirror technologies relate to the management of disconnected machines or roaming users and includeroaming user profiles,folder redirection, andoffline files.
To accomplish the goal of central management of a group of computers, machines should receive and enforce GPOs. A GPO that resides on a single machine only applies to that computer. To apply a GPO to a group of computers, Group Policy relies onActive Directory (or on third-party products likeZENworks Desktop Management) for distribution. Active Directory can distribute GPOs to computers which belong to aWindows domain.
By default, Microsoft Windows refreshes its policy settings every 90 minutes with a random 30 minutes offset. Ondomain controllers, Microsoft Windows does so every five minutes. During the refresh, it discovers, fetches and applies all GPOs that apply to the machine and to logged-on users. Some settings - such as those for automated software installation, drive mappings, startup scripts or logon scripts - only apply during startup or user logon. SinceWindows XP, users can manually initiate a refresh of the group policy by using thegpupdatecommand from acommand prompt.[4]
Group Policy Objects are processed in the following order (from top to bottom):[5]
The resulting Group Policy settings applied to a given computer or user are known as the Resultant Set of Policy (RSoP). RSoP information may be displayed for both computers and users using thegpresult command.[7]
A policy setting inside a hierarchical structure is ordinarily passed from parent to children, and from children to grandchildren, and so forth. This is termedinheritance. It can be blocked or enforced to control what policies are applied at each level. If a higher level administrator (enterprise administrator) creates a policy that has inheritance blocked by a lower level administrator (domain administrator), this policy will still be processed.
Where a Group Policy Preference Settings is configured and there is also an equivalent Group Policy Setting configured, then the value of the Group Policy Setting will take precedence.
WMI filtering is the process of customizing the scope of the GPO by choosing a (WMI) filter to apply. These filters allow administrators to apply the GPO only to, for example, computers of specific models, RAM, installed software, or anything available via WMI queries.
TheSystem Policy Editor was first introduced inWindows NT 4.0 Server.[8] Later,Windows 2000 Professional andWindows 2000 Server introducedGroup Policy Editor based onMicrosoft Management Console.[9]
Local Group Policy (LGP, or LocalGPO) is a more basic version of Group Policy for standalone and non-domain computers, that has existed at least sinceWindows XP,[when?] and can be applied to domain computers.[citation needed] Prior to Windows Vista, LGP could enforce a Group Policy Object for a single local computer, but could not make policies for individual users or groups. From Windows Vista onward, LGP allow Local Group Policy management for individual users and groups as well,[1] and also allows backup, importing and exporting of policies between standalone machines via "GPO Packs" – group policy containers which include the files needed to import the policy to the destination machine.[2]
Group Policy Preferences are a way for the administrator to set policies that are not mandatory, but optional for the user or computer.There is a set of group policy setting extensions that were previously known as PolicyMaker. Microsoft bought PolicyMaker and then integrated them withWindows Server 2008. Microsoft has since released a migration tool that allows users to migrate PolicyMaker items to Group Policy Preferences.[10]
Group Policy Preferences adds a number of new configuration items. These items also have a number of additional targeting options that can be used to granularly control the application of these setting items.
Group Policy Preferences are compatible with x86 and x64 versions of Windows XP, Windows Server 2003, and Windows Vista with the addition of theClient Side Extensions (also known as CSE).[11][12][13][14][15][16]
Client Side Extensions are now included inWindows Server 2008,Windows 7, andWindows Server 2008 R2.
Originally, Group Policies were modified using the Group Policy Edit tool that was integrated with Active Directory Users and ComputersMicrosoft Management Console (MMC) snap-in, but it was later split into a separate MMC snap-in called the Group Policy Management Console (GPMC). The GPMC is now a user component inWindows Server 2008 andWindows Server 2008 R2 and is provided as a download as part of theRemote Server Administration Tools forWindows Vista andWindows 7.[17][18][19][20]
Microsoft has also released a tool to make changes to Group Policy called Advanced Group Policy Management[21] (a.k.a. AGPM). This tool is available for any organization that has licensed theMicrosoft Desktop Optimization Pack (a.k.a. MDOP). This advanced tool allows administrators to have a check in/out process for modification Group Policy Objects, track changes to Group Policy Objects, and implement approval workflows for changes to Group Policy Objects.
AGPM consists of two parts - server and client.The server is a Windows Service that stores its Group Policy Objects in an archive located on the same computer or a network share.The client is a snap-in to the Group Policy Management Console, and connects to the AGPM server. Configuration of the client is performed via Group Policy.
Group Policy settings are enforced voluntarily by the targeted applications. In many cases, this merely consists of disabling the user interface for a particular function.[22]
Alternatively, a malevolent user can modify or interfere with the application so that it cannot successfully read its Group Policy settings, thus enforcing potentially lower security defaults or even returning arbitrary values.[23]
Group Policy was enhanced following its initial release inWindows 2000. For example,Windows XP has introduced a new feature called Group Policy Update which replaced thesecedit command.[24] This feature allows an administrator to force a group policy update on all computers with accounts in a particular Organizational Unit. This overrides the default scheduled task on the computer which runs thegpupdate command within 90 minutes, adjusted by a random offset to avoid overloading the domain controller.[25]
Group Policy Infrastructure Status was introduced, which can report when any Group Policy Objects are not replicated correctly amongst domain controllers.[26]
Group Policy Results Report also has a new feature that times the execution of individual components when doing a Group Policy Update.[27]
