Managing Group Policy Objects in Windows Server 2022

Posted on 19th June 2023

Managing Group Policy Objects in Windows Server 2022

Group Policy is a feature of the Microsoft Windows Server 2022 operating system that allows administrators to control the working environment of user accounts and computer accounts. Group Policy is implemented as a set of objects (GPOs) that are stored in a central location (a domain controller) and replicated to all domain controllers in the domain.

GPOs can be used to configure settings for users and computers in a variety of ways, including:

• Configuring security settings

• Specifying which applications are available to users

• Mapping network drives

• Configuring proxy settings

• Controlling the appearance of the desktop

• And much more…

Group Policy can be a very powerful tool, but it can also be confusing to configure and manage. In this article, we will take a look at some of the basics of Group Policy and show you how to manage GPOs in Windows Server 2022.

Creating a Group Policy Object

Before you can configure Group Policy, you first need to create a GPO. You can do this by using the Group Policy Management Console (GPMC), which is a free tool that can be downloaded from Microsoft.

Once you have installed the GPMC, you can launch it from the Start menu. In the GPMC, you will see a list of the domains in your forest. Expand the domain where you want to create the GPO and then right-click on the Group Policy Objects node and select New from the menu.

You will be prompted for a name for the new GPO. Give the GPO a name that describes what it will be used for. For example, if you are going to use the GPO to configure proxy settings, you might name it “Proxy Settings”.

Once you have given the GPO a name, click OK and the GPO will be created.

Editing a Group Policy Object

Once you have created a GPO, you can edit it by right-clicking on the GPO in the GPMC and selecting Edit from the menu. This will launch the Group Policy Management Editor (GPME), which is used to edit GPOs.

In the GPME, you will see a list of the settings that can be configured in a GPO. These settings are organized into categories, such as Computer Configuration and User Configuration.

You can edit the settings in a GPO by double-clicking on the setting or by right-clicking on the setting and selecting Edit from the menu.

When you edit a setting, you will be presented with a dialog box that allows you to configure the setting. The options that are available will depend on the setting that you are editing.

For example, when you edit the “Proxy Settings” setting, you will be able to specify the proxy server that will be used by clients.

Applying a Group Policy Object

Once you have created and configured a GPO, you need to apply it to a user or computer account. This is known as “linking” the GPO to an account.

You can link a GPO to an account by right-clicking on the GPO in the GPMC and selecting Link from the menu.

You will be prompted for the name of the object to link the GPO to. You can link a GPO to a user account, a computer account, or a group.

In this example, we will link the GPO to a user account. To do this, we will enter the name of the user account in the “Name” field and then click the “Browse” button.

This will open a dialog box that allows you to select the user account that you want to link the GPO to.

Once you have selected the user account, click the “OK” button.

You will see the GPO listed under the “Linked Group Policy Objects” node for the user account.

Linking a GPO to a computer account or group is similar to linking a GPO to a user account. The only difference is that you will select the computer account or group in the “Name” field instead of a user account.

Enforcing a Group Policy Object

When you link a GPO to an account, the GPO will be applied to the account the next time the user logs on or the computer starts up. However, you can also enforce a GPO immediately by right-clicking on the GPO in the GPMC and selecting “Enforce” from the menu.

This will cause the GPO to be applied to the account immediately, regardless of whether the user is logged on or the computer is started up.

Deleting a Group Policy Object

You can delete a GPO by right-clicking on the GPO in the GPMC and selecting Delete from the menu.

You will be prompted to confirm that you want to delete the GPO. Click the “Yes” button to delete the GPO.

Backing Up and Restoring Group Policy Objects

It is important to back up GPOs before making any changes to them. You can back up a GPO by right-clicking on the GPO in the GPMC and selecting Backup from the menu.

This will open a dialog box that allows you to specify the location to save the backup file to.

Once you have specified the location, click the “OK” button to start the backup process.

You can also restore a GPO from a backup by right-clicking on the GPO in the GPMC and selecting Restore from the menu.

This will open a dialog box that allows you to select the backup file to restore from.

Once you have selected the backup file, click the “OK” button to start the restore process.

Group Policy Objects and Active Directory

GPOs are stored in the SYSVOL folder on domain controllers. The SYSVOL folder is a shared folder that is used to store the GPOs for a domain.

Each GPO has two files: a GPT.INI file and a GPC.INI file. The GPT.INI file stores the settings for the GPO and the GPC.INI file stores information about when the GPO was last edited.

When you edit a GPO, the GPC.INI file is updated with the current date and time. This allows the GPO to be replicated to other domain controllers in the domain.

Group Policy Objects and Group Policy Preferences

Group Policy Preferences (GPPs) are a feature of Group Policy that allows you to configure settings that were not traditionally managed by Group Policy.

GPPs were first introduced in Windows Server 2008 and are available in all subsequent versions of Windows Server.

GPPs can be used to manage settings such as:

• Drive mappings

• Shortcuts

• Printers

• Services

• Scheduled tasks

• And much more…

GPPs are stored in the Group Policy Preferences folder, which is located in the SYSVOL folder on domain controllers.

Each GPP has two files: a .xml file and a .pol file. The .xml file stores the settings for the GPP and the .pol file stores information about when the GPP was last edited.

When you edit a GPP, the .pol file is updated with the current date and time. This allows the GPP to be replicated to other domain controllers in the domain.

Group Policy Objects and Security Filtering

Security filtering is a feature of Group Policy that allows you to control which users and computers a GPO applies to.

When you link a GPO to an Active Directory object (such as a user account, computer account, or group), the GPO will be applied to all users and computers that are members of that object.

However, you can use security filtering to control which users and computers the GPO applies to.

For example, you could link a GPO to a group that contains 100 users. However, you could use security filtering to only apply the GPO to 10 of those users.

Security filtering is configured by right-clicking on the GPO in the GPMC and selecting “Security Filtering” from the menu.

This will open a dialog box that allows you to add or remove users and computers from the security filter.

Adding a user or computer to the security filter will cause the GPO to be applied to that user or computer. Removing a user or computer from the security filter will cause the GPO to not be applied to that user or computer.

Group Policy Objects and WMI Filtering

WMI filtering is a feature of Group Policy that allows you to control which users and computers a GPO applies to by using a WMI Query.

WMI Queries are used to query information about a computer, such as the operating system version, the computer model, and the computer manufacturer.

You can use WMI Queries to control which users and computers a GPO applies to.

For example, you could use a WMI Query to only apply a GPO to computers that are running Windows 10.

WMI filtering is configured by right-clicking on the GPO in the GPMC and selecting “WMI Filtering” from the menu.

This will