Q

Active Directory Group Policy Objects (GPO) basics

Expert Laura E. Hunter runs down the basics of Active Directory Group Policy Objects (GPOs)

I am VERY inexperienced with Active Directory, but am in a position where I need to evaluate certain areas of security and policies in a new implementation. I am having a hard time understanding how the GPOs are used, how they are pushed down to various sub domains (if they are pushed down at all), and how GPOs affect member servers.

Let me give you some background so this makes sense. There is the root domain, 6 sub domains (A, B, C, D, E, F) and 4 sub domains (1, 2, 3, 4) under domain C.

I was told that domains A-F each have their own GPO, and that domains 1-4 use the GPO in domain C. I was also told that the root domain has a default GPO. How do GPOs work when there are different policies at different levels? Does one get priority? Is there a setting I can check to see which gets applied?

Also, how do member servers in domains 1-4 work? Do they get the same password and audit settings as dictated in domain C or can they be setup differently?

Again, any help on this (or extra advice you want to just throw in) is GREATLY appreciated.

Group Policy objects are applied in the following order – Local machine policies are applied first, followed by Site policies, followed by Domain policies, followed by policies applied to individual Organizational units. A user or computer object can only belong to a single site and a single domain at any one time, so they will receive only those GPOs that are linked to that site or domain. In your example, objects in Domain C will receive any Group Policies that are linked to Domain C. Domain C's child domains will not "inherit" those Group Policies by default, you would need to either create a separate Group Policy for the child domains, or else you can manually link the same GPO to multiple domains.

There are a number of excellent online and print resources on Group Policy, including books by Jeremy Moskowitz, Darren Mar-Elia, and myself. Check out the following links for more information:

GPanswers.com
GPOguy.com
APress.com

This was first published in September 2005

Dig deeper on Microsoft Group Policy Management

Pro+

Features

Enjoy the benefits of Pro+ membership, learn more and join.

Have a question for an expert?

Please add a title for your question

Get answers from a TechTarget expert on whatever's puzzling you.

You will be able to add details on the next page.

0 comments

Oldest 

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

-ADS BY GOOGLE

SearchServerVirtualization

SearchCloudComputing

SearchExchange

SearchSQLServer

SearchWinIT

SearchEnterpriseDesktop

SearchVirtualDesktop

Close