What Is a Group Policy Object?
A Group Policy Object (GPO) is a collection of configuration settings stored in Active Directory that can be applied to computers and users to enforce a desired state without touching each machine individually. Every GPO is made of two halves: a Group Policy Container (GPC), an Active Directory object holding version numbers and metadata, and a Group Policy Template (GPT), a folder under SYSVOL containing the actual registry.pol files, scripts, and security templates. When a domain-joined computer boots or a user logs on, the Group Policy client-side extensions read both halves and apply the resulting settings to the registry, security subsystem, or file system.
Cricket analogy: A GPO is like a team's official playing conditions document handed to every player before a match, specifying field restrictions and powerplay rules that apply uniformly regardless of who is batting.
Computer Configuration vs. User Configuration
Every GPO is split into two independent nodes: Computer Configuration and User Configuration. Computer Configuration settings apply during system startup and every background refresh regardless of who logs on, covering things like service startup types, firewall rules, and security options. User Configuration settings apply during logon and background refresh for the specific user, covering things like desktop wallpaper restrictions, mapped drives, and folder redirection. A single GPO can contain settings in both nodes, but administrators often disable the unused half (via GPO status) to speed up processing, since an empty node is still evaluated unless explicitly disabled.
Cricket analogy: Computer Configuration is like ground regulations that apply no matter which team is playing, while User Configuration is like a specific batter's individual guard markings that only matter when that batter is at the crease.
GPO Linking and Application Order
A GPO by itself does nothing until it is linked to a site, domain, or organizational unit (OU); the same GPO can be linked to multiple containers, and the same container can have multiple GPOs linked to it. Processing follows the well-known LSDOU order: Local policy first, then Site-linked GPOs, then Domain-linked GPOs, then Organizational Unit GPOs from the highest OU down to the OU containing the object, with later-applied (closer) GPOs winning conflicts by default. This ordering is why a setting configured in a domain-level GPO can be overridden by a more specific OU-level GPO further down the tree.
Cricket analogy: GPO linking is like a coaching manual that can be issued to the national team, a specific franchise, or one youth academy, with the academy's local instructions taking precedence over the national manual when they conflict.
# List all GPOs in the domain with their GUID and links
Get-GPO -All | Select-Object DisplayName, Id, GpoStatus
# Create a new GPO and link it to an OU
New-GPO -Name "Finance-Desktop-Restrictions" | New-GPLink -Target "OU=Finance,DC=contoso,DC=com"
# View the full report (settings + links) for a specific GPO
Get-GPOReport -Name "Finance-Desktop-Restrictions" -ReportType Html -Path C:\Reports\finance-gpo.htmlGPOs live in two places that must stay in sync: the Group Policy Container in Active Directory (visible via ADSI Edit under CN=Policies) and the Group Policy Template folder under \\<domain>\SYSVOL\<domain>\Policies\{GUID}. Replication lag between domain controllers for either half can cause a GPO to appear applied on one DC but not another until SYSVOL and AD replication both converge.
Never edit the default GPOs 'Default Domain Policy' or 'Default Domain Controllers Policy' directly for custom settings. Microsoft recommends creating separate GPOs for password policy tweaks, account lockout changes, or DC-specific settings, because restoring the defaults after accidental corruption is far harder if custom settings are mixed in.
- A GPO consists of a Group Policy Container in AD and a Group Policy Template folder in SYSVOL.
- Computer Configuration applies at boot and background refresh regardless of the logged-on user; User Configuration applies at logon per user.
- GPOs do nothing until linked to a site, domain, or OU, and one GPO can be linked to multiple containers.
- Processing order follows LSDOU: Local, Site, Domain, then OU from highest to lowest, with the closest link normally winning conflicts.
- Get-GPO, New-GPLink, and Get-GPOReport are core PowerShell cmdlets for managing and auditing GPOs.
- Avoid customizing the Default Domain Policy or Default Domain Controllers Policy directly; create dedicated GPOs instead.
Practice what you learned
1. What are the two components that together make up a Group Policy Object?
2. What must happen before a GPO has any effect on users or computers?
3. What does the LSDOU processing order stand for, and what does it determine?
4. Which PowerShell cmdlet generates a full HTML report of a GPO's settings and links?
5. Why do administrators typically avoid customizing the Default Domain Policy directly?
Was this page helpful?
You May Also Like
GPO Scope and Inheritance
How GPO scope is controlled through linking, security filtering, WMI filtering, Block Inheritance, and Enforced links, and how conflicts are resolved.
Common GPO Settings
A tour of the most frequently configured Group Policy settings for security baselines, password policy, software restriction, and administrative templates.
GPO Troubleshooting with gpresult and RSoP
How to diagnose Group Policy application problems using gpresult, the Resultant Set of Policy snap-in, gpupdate, and Group Policy event logs.
Group Policy Preferences
How Group Policy Preferences differ from Group Policy Policies, common preference extensions like drive maps and scheduled tasks, and item-level targeting.
Related Reading
Related Study Notes in Microsoft Technologies
Browse all study notesWindows 10 / UWP Development Study Notes
.NET · 30 topics
Microsoft TechnologiesWindows Batch Scripting Study Notes
Batch · 30 topics
Microsoft TechnologiesMFC (Microsoft Foundation Classes) Study Notes
C++ · 30 topics
Microsoft TechnologiesSilverlight Study Notes
.NET · 30 topics
Microsoft TechnologiesXAML Study Notes
.NET · 30 topics
Microsoft TechnologiesWPF (Windows Presentation Foundation) Study Notes
.NET · 30 topics