Group Policy
Following adds this technology to your private workspace so related learning is easier to organise and revisit.
What is Group Policy?
Group Policy is Microsoft's central mechanism for configuring Windows users and computers in an Active Directory domain. This profile connects the concept to KBY's practical engineering guidance.
Group Policy Objects contain settings linked to sites, domains or organisational units and are processed according to scope, inheritance, security filtering and client-side extensions. Predictable operation requires disciplined ownership and result analysis rather than relying on link order alone.
Apply centrally governed Windows configuration and security settings.
- Enforcing security settings on Windows
- Deploying software and scripts
- Mapping network drives and printers
Explore related technologies
Parent technology
4 resources for Group Policy
Browse by purpose, from definitions and learning through operations, diagnostics and controlled recovery.
Learn and operate with Group Policy
Ordered as a reader progression -- from core definitions through to operational reference -- using only the content already connected in the technology registry.
Lexicon Definitions(1)
Start here: understand the core vocabulary.
Config Traps(3)
Recognise and avoid known failure modes.
- Removed Authenticated Users From a GPO's Security Filter and Broke Policy DeliveryRemoving Authenticated Users from a GPO's security filter to scope delivery silently blocks policy application on computers unless the replacement group explicitly holds Apply Group Policy rights. Open
- cpassword Survives in SYSVOL Backups and VSS ShadowsRemoving a Group Policy Preferences password field from the console only deletes the live XML file. DFSR staging folders, VSS shadow copies on domain controllers, and System State backups retain earlier versions of Groups.xml, Drives.xml, and ScheduledTasks.xml indefinitely, keeping a reversibly-encrypted credential recoverable long after the GPO looks clean. Open
- SYSVOL cpassword: The GPP Field That Never DiedLegacy Group Policy Preferences store cpassword credentials in SYSVOL XML files encrypted with a static AES key Microsoft published years ago. MS14-025 blocked new GUI writes but never purged existing files, so any authenticated domain user can decrypt them instantly and gain shared local admin access fleet-wide. Open