What is Group Policy Management Console (GPMC)?

Group Policy Management Console (GPMC) is aMicrosoft Management Console snap-in that provides agraphical user interface that enables Active Directory (AD) administrators to manage Group Policy Objects (GPOs) from one console.

Before GPMC, administrators had to use many tools to create, edit and import settings; back up and manage GPOs; and apply them to specific users or computers in the domain. GPMC provides a view of all GPOs, organizational units (OUs), domains and sites across an enterprise and enables editing settings within individual GPOs. Also, GPMC combines the functionality of such tools as AD Users and Computers, AD Sites and Services, Resultant Set of Policy,Access Control List Editor and GPMC Delegation Wizard.

For developers, GPMC includes a set of programmable interfaces for managing Group Policy withscripts orC/C++, which permits thecreating, backing up, restoring, importing, copying, deleting and renaming of GPOs; linking GPOs andWindows Management Instrumentation filters; and completing several reporting tasks.

What is Enforce in Group Policy Management Console?

Enforce is a setting in GPMC that determines whether the policy settings configured in a GPO are actively enforced on computers and users covered by those settings. Whenever GPMC is set to Enforce, it applies all configured policy settings to those computers and users. Whenever it is not set to Enforce, none of the GPO's policy settings are applied, even if configured.

Group Policy settings are inherited from parent containers to child containers in a hierarchical structure by default. If a setting does not define a child container's GPO, it inherits the setting from its parent container's GPO.

When a GPO is enforced, it ensures that its settings are applied across all users and computers within its scope, regardless of any other conflicting GPOs linked to parent containers.

Enforcing a GPO creates a "no override" policy setting on the GPO, which prevents any other GPOs linked to parent containers from overriding the GPO's settings. When enforcing multiple GPOs at various levels in the hierarchy, the GPO with the highest enforcement level precedes any conflicting settings from lower-level GPOs.

The Enforce option must be used with caution because it can result in unexpected consequences, especially when it is not managed correctly. Organizations must Enforce a GPO only when necessary, for example, to ensure that critical settings are applied consistently and without conflict.

How to open Group Policy Management Console

To open GPMC on a Windows device, follow these steps:

1. Press theWindows key + R to open the Run dialog box.
2. In the Run dialog box, typegpmc.msc, and pressEnter or clickOK.
3. The GPMC window opens and displays a hierarchical view of theAD forest and domains.

Alternatively, you can also open GPMC using the following method:

1. Click on theStart menu. Search forGroup Policy Management Console orGPMC.
2. Click on the search result to open GPMC.

How to edit GPO in Active Directory

To edit a GPO in AD, follow these steps:

1. Open GPMC by typinggpmc.msc in the Run dialog box or by searching forGroup Policy Management Console in the Start menu.
2. Navigate to the GPO folder for the domain or OU, and locate the GPO you want to edit.
3. Right-click on the GPO you want to edit, and selectEdit from the context menu. This opens the GPO in Group Policy Object Editor.
4. You can navigate the different policy sections by expanding the folders in the left pane of Group Policy Editor. Each policy section contains a set of policies that can be configured for the GPO.
5. To edit a policy setting, double-click on it, or right-click on it and selectEdit. This opens the policy configuration dialog box, where you can modify the setting.
6. After making changes to the policy settings, clickOK to save the changes and close the configuration dialog box.

Once you have finished editing, close Group Policy Object Editor and GPMC. It is important to note that changes do not take effect until the GPO links to a site, domain or OU. All affected users or computers must also reboot or update their Group Policy.

Learn how toavoid common Group Policy Objectbackup and restore problems.