Where the common Group Policy settings live in the Group Policy Management Editor, plus the commands and rules that decide which settings win.
Paths below are as shown when you edit a domain GPO in gpmc.msc. In the local editor (gpedit.msc) there is no Policies or Preferences level.
Security settings
| Setting |
Path |
| Password policy |
Computer Configuration > Policies > Windows Settings > Security Settings > Account Policies > Password Policy |
| Account lockout |
Computer Configuration > Policies > Windows Settings > Security Settings > Account Policies > Account Lockout Policy |
| Kerberos policy |
Computer Configuration > Policies > Windows Settings > Security Settings > Account Policies > Kerberos Policy |
| Audit policy (basic) |
Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Audit Policy |
| Audit policy (advanced, preferred) |
Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies |
| User rights (log on locally, via RDP, as a service) |
Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > User Rights Assignment |
| Security options (logon banner, idle lock, SMB signing) |
Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options |
| Restricted Groups (control local group membership) |
Computer Configuration > Policies > Windows Settings > Security Settings > Restricted Groups |
| Windows Firewall rules and profiles |
Computer Configuration > Policies > Windows Settings > Security Settings > Windows Defender Firewall with Advanced Security |
| Software Restriction Policies |
Computer Configuration > Policies > Windows Settings > Security Settings > Software Restriction Policies (also under User Configuration) |
| AppLocker |
Computer Configuration > Policies > Windows Settings > Security Settings > Application Control Policies > AppLocker |
- Domain password and lockout policy only works from a GPO linked at the domain (normally the Default Domain Policy). Linked to an OU, it only affects local accounts on computers in that OU. Use Fine-Grained Password Policies for different rules per group.
- Do not mix basic and advanced audit policy. When using advanced, enable Security Options > “Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings”.
- AppLocker needs the Application Identity service (
AppIDSvc) running on the client. For new deployments Microsoft points to App Control for Business.
Administrative Templates
| Setting |
Path |
| Windows Update, WSUS server, restart behavior |
Computer Configuration > Policies > Administrative Templates > Windows Components > Windows Update |
| BitLocker (OS, fixed and removable drives) |
Computer Configuration > Policies > Administrative Templates > Windows Components > BitLocker Drive Encryption |
| Microsoft Defender Antivirus |
Computer Configuration > Policies > Administrative Templates > Windows Components > Microsoft Defender Antivirus |
| Allow Remote Desktop connections |
Computer Configuration > Policies > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Connections |
| Removable storage (USB drives, CD/DVD) |
Computer Configuration > Policies > Administrative Templates > System > Removable Storage Access (also under User Configuration) |
| Block device installs by ID or class |
Computer Configuration > Policies > Administrative Templates > System > Device Installation > Device Installation Restrictions |
| Wait for the network at startup and logon |
Computer Configuration > Policies > Administrative Templates > System > Logon |
| Loopback processing |
Computer Configuration > Policies > Administrative Templates > System > Group Policy |
| Windows LAPS |
Computer Configuration > Policies > Administrative Templates > System > LAPS |
| Lock down Control Panel and Settings |
User Configuration > Policies > Administrative Templates > Control Panel |
- Windows Update: newer templates group settings into subfolders, for example Configure Automatic Updates under Manage end user experience, and Specify intranet Microsoft update service location (WSUS) under Manage updates offered from Windows Server Update Service.
- BitLocker: to back up recovery keys to AD, use “Choose how BitLocker-protected operating system drives can be recovered” under Operating System Drives.
- Removable storage: “All Removable Storage classes: Deny all access” blocks every class at once.
Scripts, software and folders
| Setting |
Path |
| Logon and logoff scripts |
User Configuration > Policies > Windows Settings > Scripts (Logon/Logoff) |
| Startup and shutdown scripts |
Computer Configuration > Policies > Windows Settings > Scripts (Startup/Shutdown) |
| Software installation (MSI packages) |
Computer Configuration > Policies (or User Configuration > Policies) > Software Settings > Software Installation |
| Folder Redirection (Documents, Desktop) |
User Configuration > Policies > Windows Settings > Folder Redirection |
Each Scripts dialog has a PowerShell Scripts tab for .ps1 files. Startup scripts run as SYSTEM, logon scripts run as the user.
Preferences (GPP)
| Item |
Path |
| Drive maps |
User Configuration > Preferences > Windows Settings > Drive Maps |
| Registry values |
Computer or User Configuration > Preferences > Windows Settings > Registry |
| Files, folders, shortcuts, environment variables |
Computer or User Configuration > Preferences > Windows Settings |
| Printers |
Computer or User Configuration > Preferences > Control Panel Settings > Printers |
| Local users and groups |
Computer or User Configuration > Preferences > Control Panel Settings > Local Users and Groups |
| Scheduled tasks, power options |
Computer or User Configuration > Preferences > Control Panel Settings |
| Services |
Computer Configuration > Preferences > Control Panel Settings > Services |
- Actions: Create (only if missing), Replace (delete and recreate), Update (change or create, the usual choice), Delete.
- Item-level targeting (Common tab) applies an item only to certain groups, OUs, IP ranges, operating systems and more.
- Preferences are not enforced like policies: users can change them until the next refresh. Tick “Remove this item when it is no longer applied” to clean up.
Commands
| Task |
Command |
| Apply changed settings now |
gpupdate |
| Reapply every setting |
gpupdate /force |
| Computer or user side only |
gpupdate /target:computer, gpupdate /target:user |
| Refresh and log off or restart if an extension needs it |
gpupdate /force /logoff, gpupdate /force /boot |
| Summary of applied GPOs and security groups |
gpresult /r |
| Computer side only (run elevated) |
gpresult /r /scope computer |
| Full HTML report |
gpresult /h C:\Temp\gp.html /f |
| Another user on a remote PC |
gpresult /s PC01 /user CONTOSO\jdoe /r |
| Old RSoP console (does not show Preferences) |
rsop.msc |
| Management console, local editor |
gpmc.msc, gpedit.msc |
GroupPolicy PowerShell module
| Task |
Command |
| Remote refresh now |
Invoke-GPUpdate -Computer PC01 -Force -RandomDelayInMinutes 0 |
| RSoP report |
Get-GPResultantSetOfPolicy -ReportType Html -Path C:\Temp\rsop.html |
| List all GPOs |
Get-GPO -All | Select-Object DisplayName, GpoStatus, ModificationTime |
| Report on one GPO |
Get-GPOReport -Name 'Workstation Baseline' -ReportType Html -Path C:\Temp\gpo.html |
| New GPO and link it to an OU |
New-GPO -Name 'Kiosk Lockdown' | New-GPLink -Target 'OU=Kiosks,DC=contoso,DC=com' |
| What is linked and inherited on an OU |
Get-GPInheritance -Target 'OU=Kiosks,DC=contoso,DC=com' |
| Back up every GPO |
Backup-GPO -All -Path C:\GPOBackups |
Invoke-GPUpdate creates a scheduled task on the target, so it needs RPC and WMI access: TCP 135 and the dynamic range 49152-65535 inbound.
Processing order: LSDOU
| Order |
Level |
Notes |
| 1 |
Local |
The computer’s own local policy |
| 2 |
Site |
GPOs linked to the AD site |
| 3 |
Domain |
GPOs linked to the domain |
| 4 |
OU |
Parent OU first, then each child OU down to the object’s own OU |
- Last applied wins, so the OU closest to the object beats the domain, and the domain beats local policy.
- Within one container, link order 1 has the highest precedence (it is applied last).
- Enforced on a link makes it win over GPOs linked lower down, and it ignores Block Inheritance.
- Block Inheritance on an OU stops GPOs from higher levels, except Enforced links.
- Security filtering and WMI filters decide which users and computers a GPO applies to. The computer account needs Read on the GPO (Authenticated Users or Domain Computers).
- Computer settings apply at startup, user settings at sign-in. Background refresh runs about every 90 minutes plus a random offset of up to 30 minutes; domain controllers refresh every 5 minutes.
- Disabling the unused half of a GPO (User or Computer settings) speeds up processing.
Loopback processing
Normally user settings come from the user’s OU. Loopback makes user settings follow the computer instead, for kiosks, labs, and Remote Desktop servers. Set “Configure user Group Policy loopback processing mode” in a GPO that applies to the computers.
| Mode |
Result |
| Merge |
User settings from the user’s OU apply first, then user settings from GPOs on the computer’s OU. On a conflict, the computer’s GPOs win. |
| Replace |
Only user settings from GPOs that apply to the computer are used. The user’s normal user settings are ignored. |
