Group Policy lets you manage Windows users and computers from Active Directory instead of configuring every machine manually.
The safe setup is:
Create OUs Create a new GPO Link it to one test OU Edit the policy Run gpupdate Verify with gpresult Back up the GPO Only then expand to production OUs
Do not start by editing the Default Domain Policy.
Do not link a new policy to the whole domain before testing.
Do not use Group Policy as a random collection of settings.
A good GPO setup should be:
- scoped to the right OU;
- named clearly;
- tested on a small group first;
- documented;
- backed up;
- verified with
gpresult; - easy to roll back.
For a small Windows Server or MSP environment, start with a few focused policies:
- server baseline security;
- RDP rules;
- screen lock;
- Windows Update behavior;
- drive mappings;
- printer mappings;
- browser settings;
- RDS Session Host loopback policy where needed.
Quick verdict
| Situation | Recommended approach |
|---|---|
| First GPO in a new domain | Create a test OU and link a simple GPO there |
| Server hardening | Use computer-side GPOs linked to server OUs |
| User desktop settings | Use user-side GPOs linked to user OUs |
| RDS Session Host user settings | Use loopback processing on the RDS computer OU |
| Password policy for domain users | Configure at domain level or use fine-grained password policies |
| Drive maps or printers | Use Group Policy Preferences |
| Security settings | Use Group Policy policies, not preferences |
| Production rollout | Test with gpupdate and gpresult before broad linking |
| Rollback planning | Back up GPOs before major changes |
Simple rule:
Use OUs for targeting. Use GPOs for settings. Use gpresult to prove what actually applied.
What Group Policy is
Group Policy is an Active Directory feature that lets administrators define managed configuration for users and computers.
A Group Policy Object, or GPO, can control settings such as:
- Windows security options;
- password and lockout rules;
- Windows Firewall;
- Remote Desktop behavior;
- mapped drives;
- printers;
- browser settings;
- scripts;
- Windows Update behavior;
- audit policy;
- account rights;
- RDS Session Host behavior;
- administrative templates;
- registry-based settings.
In an Active Directory environment, Group Policy is managed with the Group Policy Management Console, or GPMC.
You can open it with:
gpmc.msc
A GPO does not do anything until it is linked to a scope.
Common scopes are:
- site;
- domain;
- organizational unit.
For most small and mid-sized environments, OUs are the safest place to apply GPOs.
GPO vs OU vs link
These three terms are easy to confuse.
GPO
A GPO is the collection of policy settings.
Example:
Server - RDP Security Baseline
That GPO might contain settings for RDP, firewall, screen lock, and local administrator restrictions.
OU
An OU is an Active Directory container for users, computers, or other OUs.
Example:
OU=Servers OU=RDS-Servers OU=Accounting-Users OU=Test-Computers
OUs help you organize objects and target policies.
Link
A link connects a GPO to a site, domain, or OU.
A single GPO can be linked to more than one OU.
Example:
GPO: Server - RDP Security Baseline Linked to: OU=Servers
That means the policy applies to computers inside the Servers OU, unless filtering, blocking, inheritance, or precedence changes the result.
What you'll need
Before starting, prepare:
- an Active Directory domain;
- at least one domain controller;
- Domain Admin rights or delegated GPO management rights;
- Group Policy Management Console;
- at least one test user or computer;
- a test OU;
- DNS working correctly;
- SYSVOL and NETLOGON healthy on domain controllers;
- 30-45 minutes for first setup.
If you do not have a domain controller yet, promote a Windows Server VM to a domain controller first.
If you are using multiple domain controllers, verify replication before editing GPOs.
Run:
repadmin /replsummary
If replication is broken, fix that before relying on Group Policy.
Step 1 — Install or open Group Policy Management Console
On a domain controller, GPMC is usually available.
Open it:
Win + R gpmc.msc
On a member server, install the feature:
Install-WindowsFeature GPMC
On an admin workstation, install the Remote Server Administration Tools that include Group Policy Management.
After opening GPMC, expand:
Forest: yourdomain.local ↓ Domains ↓ yourdomain.local
You should see:
- Default Domain Policy;
- Default Domain Controllers Policy;
- Group Policy Objects;
- your OUs.
Step 2 — Do not edit the default policies for normal settings
A clean domain has two important default GPOs.
| Default GPO | Purpose |
|---|---|
| Default Domain Policy | Domain-level account policy baseline |
| Default Domain Controllers Policy | Domain controller security baseline |
Do not use these as general-purpose policy containers.
Avoid putting random settings into them.
A safer rule:
Leave default policies mostly clean. Create separate GPOs for separate purposes.
Good GPO names:
Server - RDP Security Baseline Server - Windows Update Policy Users - Drive Maps Users - Browser Settings RDS - User Experience Policy Workstations - Screen Lock Policy
Bad GPO names:
New Policy Test Security Stuff Office settings
Good naming makes troubleshooting much easier later.
Step 3 — Create a test OU
Before creating your first policy, create a test OU.
Example structure:
contoso.local ├── Servers ├── Workstations ├── Users └── Test ├── Test-Computers └── Test-Users
You can create this in Active Directory Users and Computers:
dsa.msc
Or with PowerShell:
New-ADOrganizationalUnit -Name "Test" -Path "DC=contoso,DC=local" New-ADOrganizationalUnit -Name "Test-Computers" -Path "OU=Test,DC=contoso,DC=local" New-ADOrganizationalUnit -Name "Test-Users" -Path "OU=Test,DC=contoso,DC=local"
Move one test computer and one test user into those OUs.
Do not test first policies on production users.
Step 4 — Create your first GPO
Use a simple, safe example first.
In GPMC:
- Right-click the test OU.
- Click Create a GPO in this domain, and Link it here.
- Name it:
Test - Screen Lock Policy
- Right-click the new GPO.
- Click Edit.
This opens the Group Policy Management Editor.
For this example, configure a screen lock policy.
Go to:
User Configuration → Policies → Administrative Templates → Control Panel → Personalization
Configure:
| Setting | Value |
|---|---|
| Enable screen saver | Enabled |
| Password protect the screen saver | Enabled |
| Screen saver timeout | Enabled, 900 seconds |
This is a safer first policy than password lockout because it affects only users in the test OU.
Step 5 — Understand computer settings vs user settings
Group Policy has two main halves.
| GPO section | Applies to |
|---|---|
| Computer Configuration | Computer objects |
| User Configuration | User objects |
Computer settings apply to computers.
User settings apply to users.
That sounds obvious, but many GPO issues come from linking the GPO to the wrong OU.
Example:
You configure User Configuration settings. You link the GPO to an OU that contains only computers. Nothing happens to users.
Another example:
You configure Computer Configuration settings. You link the GPO to an OU that contains only users. Nothing happens to computers.
For mixed policies, be intentional.
If a GPO contains only user settings, link it to user OUs.
If a GPO contains only computer settings, link it to computer OUs.
Step 6 — Apply the GPO on a test client
Sign in to the test client as the test user.
Run Command Prompt or PowerShell:
gpupdate /force
If the policy requires logoff, log off and sign back in.
If the policy requires reboot, reboot.
Then verify policy application:
gpresult /r
For a cleaner report:
gpresult /h C:\GPOReport.html
Open:
C:\GPOReport.html
Look for your GPO name under applied Group Policy Objects.
Expected:
Test - Screen Lock Policy
If it is not listed, check OU placement, link status, security filtering, WMI filtering, and whether the setting is user-side or computer-side.
Step 7 — Use Group Policy Results in GPMC
GPMC also has a visual report tool.
In Group Policy Management:
- Right-click Group Policy Results.
- Click Group Policy Results Wizard.
- Select the target computer.
- Select the target user.
- Generate the report.
This is useful when a user says:
The policy did not apply.
You can check what actually applied to that user and computer combination.
Do not guess.
Use results.
Step 8 — Use Group Policy Modeling before broad rollout
Group Policy Modeling predicts what should happen before you apply a policy broadly.
Use it when:
- moving users between OUs;
- applying a new policy to a production OU;
- testing loopback processing;
- checking security filtering;
- planning RDS policies;
- troubleshooting inheritance.
In GPMC:
- Right-click Group Policy Modeling.
- Run the wizard.
- Choose user, computer, OU, site, and group membership assumptions.
- Review predicted settings.
Modeling does not replace real testing, but it helps avoid surprises.
Step 9 — Know the processing order
Group Policy processing usually follows this order:
Local Site Domain OU Child OU
This is often remembered as:
LSDOU
When settings conflict, the more specific policy usually wins.
That means a policy linked to a child OU can override a setting from the domain level, unless options like Enforced, Block Inheritance, security filtering, or WMI filtering change the result.
Avoid complex precedence unless you need it.
A simple OU design is easier to support.
Step 10 — Security filtering
Security filtering controls who or what a GPO applies to.
By default, GPOs often apply to:
Authenticated Users
That includes both users and computers for read/apply purposes.
If you replace Authenticated Users with a specific security group, make sure the right user or computer objects are included.
Common mistake:
Computer-side policy Security filter contains only user accounts Result: computer policy does not apply
For computer-side policy, filter to computer accounts or groups containing computers.
For user-side policy, filter to users or user groups.
When troubleshooting, always check the Delegation tab and Security Filtering section.
Step 11 — Use Group Policy Preferences correctly
Group Policy has two broad types of settings.
| Type | Best for | Behavior |
|---|---|---|
| Policies | Security and enforced configuration | User usually cannot override |
| Preferences | Convenience and default configuration | Can create, update, replace, or delete settings |
Use Policies for:
- security options;
- Windows Firewall;
- audit policy;
- RDP restrictions;
- account rights;
- lock screen;
- Windows Update policy.
Use Preferences for:
- drive maps;
- printer maps;
- shortcuts;
- environment variables;
- local group membership;
- registry preferences;
- files and folders.
Example drive map:
User Configuration → Preferences → Windows Settings → Drive Maps
A drive mapping is a convenience setting, so Preferences are the right tool.
A firewall rule is a security setting, so Policies are the better tool.