Group Policy (GPO) in Active Directory: A Simple Guide from Basic to Advanced

In our last post, we set up an Active Directory server. Now comes the most useful part: Group Policy (GPO). Imagine you need to block USB drives on 200 computers, or set the same wallpaper for every employee. Doing it one PC at a time would take days. With Group Policy, you do it once from the server, and it applies to every computer automatically.

1. What is Group Policy?

Think of Group Policy as the rule book of your office. You write a rule once, stick it on a department's notice board (an OU), and everyone in that department follows it.

Key terms:

• GPO (Group Policy Object) – One set of rules, for example "Block USB" or "Company Wallpaper".
• Link – Attaching a GPO to a Site, Domain or OU. A GPO does nothing until it is linked.
• Computer Configuration – Rules for the machine. They apply when the PC starts, no matter who logs in.
• User Configuration – Rules for the person. They apply when the user logs in, on any PC.
• GPMC – Group Policy Management Console, the tool you use to create and manage GPOs.

2. How Group Policy Is Applied (LSDOU)

GPOs are applied in a fixed order: Local → Site → Domain → OU. If two rules conflict, the last one applied wins. So a rule on an OU overrides the same rule set at the domain level.

3. Requirements

• A working Active Directory domain (see our previous post).
• Group Policy Management Console (GPMC) – installed on the DC by default. On Windows 10/11, install it with RSAT.
• Users and computers placed in the right OUs. Note: GPOs cannot be linked to the default "Users" and "Computers" containers.
• An account in Domain Admins or Group Policy Creator Owners.

4. Step-by-Step: Create Your First GPO

Step 1: Open Group Policy Management

On the DC, open Server Manager → Tools → Group Policy Management. Expand Forest → Domains → your domain.

Step 2: Create and Link a GPO

Right-click the OU you want (for example IT) → "Create a GPO in this domain, and Link it here" → give it a clear name like "IT - Block USB". Or with PowerShell:

New-GPO -Name "IT - Block USB" | New-GPLink -Target "OU=IT,DC=corp,DC=company,DC=com"

Step 3: Edit the GPO

Right-click the new GPO → Edit. The Group Policy Management Editor opens. Here are three popular examples:

Task	Where to find it
Block USB drives	Computer Configuration → Policies → Administrative Templates → System → Removable Storage Access → All Removable Storage classes: Deny all access → Enabled
Set company wallpaper	User Configuration → Policies → Administrative Templates → Desktop → Desktop → Desktop Wallpaper → Enabled, and enter a shared path like \\DC01\Wallpaper\logo.jpg
Map a network drive	User Configuration → Preferences → Windows Settings → Drive Maps → New → Mapped Drive → enter the share path and drive letter

Step 4: Apply and Test

GPOs refresh automatically about every 90 minutes. To apply right away, run this on the client PC:

gpupdate /force

To see which GPOs were applied:

gpresult /r
gpresult /h C:\gpreport.html

The second command creates a clear HTML report you can open in a browser.

5. Advanced Group Policy

• Security Filtering: Apply a GPO only to a specific group instead of everyone in the OU. Select the GPO → Scope tab → Security Filtering.
• WMI Filtering: Apply a GPO only to certain machines, for example only laptops or only Windows 11.
• Enforced: Forces a GPO to apply even if a lower-level GPO conflicts with it. Use it for must-have security rules.
• Block Inheritance: Stops an OU from receiving GPOs from above. Enforced GPOs still apply.
• Loopback Processing: Applies user settings based on the computer, not the user. Useful for shared PCs, kiosks and RDS servers.
• Central Store: Copy ADMX template files to \\domain\SYSVOL\domain\Policies\PolicyDefinitions so all admins see the same, up-to-date settings.
• Password Policy: Domain password rules must be set in a GPO linked at the domain level (usually Default Domain Policy). For different rules per group, use Fine-Grained Password Policies.

6. Best Practices

• Use clear names, for example "Sales - Drive Map", so anyone can understand what a GPO does.
• Make one GPO for one purpose. Small GPOs are easier to troubleshoot.
• Do not edit Default Domain Policy for everything. Keep it for password and account policies only.
• Test new GPOs on a test OU first, then link them to real users.
• Back up your GPOs regularly:

Backup-GPO -All -Path "D:\GPO-Backup"

7. Common Problems and Quick Fixes

Problem	Solution
GPO not applying at all	Check the GPO is linked to the right OU and the user/PC is actually in that OU
User setting not working	Make sure the setting is in User Configuration and the GPO is linked where the user account is
Computer setting not working	Restart the PC. Some computer settings only apply at startup
Wrong setting wins	Remember LSDOU. Check link order, Enforced and Block Inheritance with gpresult /h
Slow GPO processing	Check DNS on the client and remove unused GPOs

Conclusion

Group Policy turns Active Directory from a simple user list into a powerful control center. Start small: create one GPO, link it to a test OU, run gpupdate /force and check with gpresult. Once you are comfortable, add security filtering and advanced options step by step.

Have a question? Ask in the comments. In the next post, we will set up a File Server with shared folders and NTFS permissions!