Implementing and Managing Group Policy in Active Directory

Introduction

Group Policy, first introduced by Microsoft with Windows 2000, allows managing and configuring operating systems, applications, and users in a Windows environment. It enables administrators to define configurations for users and computers across an Active Directory (AD) domain, ensuring a standardized and secure IT environment. This guide will walk you through the essentials of creating, implementing, and managing Group Policies in an Active Directory setting.

What are Group Policy?

Group Policy allows administrators to centrally apply settings to operating systems, applications, and users in a Windows environment. Changing settings in the GUI modifies registry keys on the targeted system to apply specific configurations.

Local vs. Domain Managed Group Policy

• Local Group Policy: Applied to individual computers and doesn't require AD.
• Domain Managed Group Policy: Applied across multiple computers within an AD domain, providing centralized management. These GPOs will always take precedence over local group policy.

User vs. Computer Policy

• User Policies: Apply settings based on the user's login. These settings follow the user across different machines. Examples include setting up specific desktop backgrounds or redirecting folders.
• Computer Policies: Apply settings based on the machine itself, regardless of who logs in, such as configuring firewall rules or setting power options.

Group Policy Templates

When installing your AD DS environment, your Active Directory already has predefined Group Policies. However, suppose you wish to add specific functions or settings to them. In that case, you must update them by downloading predefined Group Policy Templates provided by Microsoft or third-party vendors. For example, templates for managing Google Chrome settings or supporting the latest Windows version.

Prerequisites

This post expects that you want to manage GPOs centrally. However, GPOs work locally without the need for the computer to be in an Active Directory. To manage them centrally, you will need Active Directory Domain Services (AD DS) and either the Group Policy Creator Owner Role or Domain Admin Role to manage them without needing delegated permissions.

Accessing the Group Policy Management Console

To manage Group Policies, you will use the Group Policy Management Console (GPMC), which is available on Windows Server and can be installed on administrative workstations.

1. Open the Start menu and type "Group Policy Management."
2. Select the Group Policy Management Console from the search results.

Creating Group Policy Filters

Group Policy Filters allow you to apply policies to specific groups of users or computers. This can help in targeting policies more precisely.

What are Group Policy Filters?

Filters control which objects (users or computers) a policy applies to, based on criteria like security groups, WMI queries, or specific attributes.

When to Use Filters?

Use filters when you need to apply policies to specific subsets of users or computers, such as only applying a policy to Windows clients.

Creating an Example Filter (Windows 11 Clients Only)

1. Open the GPMC.
2. Open your Domain.
3. On the WMI Filter Tab, right-click on "New" and select Add a New query.
4. As Namespace, select "root\CIMv2" and paste the query select * from Win32_OperatingSystem where ((Caption like "Microsoft Windows 11%") and (ProductType="1")) into it.

Linking Group Policy

Linking a GPO to an Organizational Unit (OU) determines which users or computers the policy will apply to.

What is Linking?

After creating a GPO, it won't be applied automatically; you need to specify where it should be applied within the AD environment. This is where GPO linking comes into play. Linking connects a GPO to an OU, site, or domain, enabling the policy to apply to the objects within that container. Links can be removed (without deleting the GPO itself) or disabled if you don't want the policy to take effect temporarily.

Why OU Structure is Important

When a GPO is linked to an OU, it uses the inheritance system to apply its changes. This means that if you apply a GPO at a higher level in the OU hierarchy, all sub-OUs and their objects will also receive this GPO. Exceptions occur if another GPO is applied further down the hierarchy, which would override the same settings specified higher up, or if the OU is set to block inheritance. Therefore, having a well-organized OU structure is essential to prevent accidental deployment of GPOs to the wrong systems or users and to maintain clear and manageable policy application across the AD environment.

Managing GPOs

Best Practices

• Keep GPOs well-documented, with the applicable OUs, the applied settings, and so on.
• Avoid using the default domain policy for custom settings.
• Use separate GPOs for user and computer settings.
• Use a naming scheme to easily allow to see, what a GPO does.

Delegating GPO Management

Assign permissions to other administrators or groups to manage specific GPOs without giving them full domain admin rights.

Updating ADMX Templates

Regularly updating your ADMX templates ensures you have the latest settings available for new applications and OS features, keeping your Group Policies current and effective.

This can be done by either installing the ADMX Templates locally on each Domain Controller or by creating a central store in the SYSVOL directory (\\SYSVOL\\Policies\PolicyDefinitions). The central store method is recommended for several reasons:

• Consistency: All Domain Controllers will use the same set of ADMX templates, ensuring uniform policy application across the domain.
• Efficiency: Administrators can manage and update the ADMX templates from a single location, reducing the need for repetitive updates on multiple Domain Controllers.
• Version Control: Having a central store simplifies the process of tracking and maintaining template versions, making it easier to manage and troubleshoot GPO settings.

To set up a central store for ADMX templates:

1. Create the Central Store:

• On a Domain Controller, navigate to the SYSVOL directory: \\SYSVOL\\Policies.
• Create a new folder named PolicyDefinitions.

2. Copy ADMX Templates to the Central Store:

• Download the latest ADMX templates from the Microsoft Download Center or relevant third-party sources.
• Extract the ADMX files and their corresponding ADML language files.
• Copy the ADMX files to \\SYSVOL\\Policies\PolicyDefinitions.
• Copy the ADML files to the appropriate language folder within the PolicyDefinitions folder (e.g., en-US for English).

3. Verify the Update:

• Open the Group Policy Management Console (GPMC).
• Create or edit a GPO to ensure that the new templates are available and functioning correctly

Testing and Troubleshooting GPOs

Before rolling out new policies, testing them to ensure they work as intended is crucial.

1. Use a test OU and move test accounts or machines into it.
2. Run the gpupdate /force command to force policy updates.
3. With gpresult /r /scope computer, you can see the applied Group Policy for the machine
4. Use the Group Policy Results Wizard in GPMC to see the applied policies and troubleshoot issues.