Group Policy Management

1. Local Computer Policy
2. Site GPOs
3. Domain GPOs
4. OU GPOs (parent to child)

Within each level: Link order (1 = last applied = wins)

Enable loopback processing:
Computer Configuration > Policies > Administrative Templates > System > Group Policy
> Configure user Group Policy loopback processing mode

Options:
- Replace: Only apply GPOs from computer's OU
- Merge: Apply both user's and computer's GPOs (computer wins on conflict)

[Scope]-[Type]-[Description]-[Version]

Examples:
CORP-SEC-Password Policy-v2
EXEC-USR-Drive Mappings
TERM-CMP-Loopback Settings
SITE-NYC-Printers

Prefixes:
CORP = Corporate-wide
DEPT = Department
SITE = Physical location
SEC = Security
USR = User settings
CMP = Computer settings

domain.com
├── Computers
│   ├── Servers
│   │   ├── Domain Controllers
│   │   ├── File Servers
│   │   └── Application Servers
│   ├── Workstations
│   │   ├── Standard
│   │   ├── Executive
│   │   └── Kiosks
│   └── Laptops
└── Users
    ├── Standard Users
    ├── Executives
    └── IT Staff

CORP-Everything
- Password policy
- Desktop wallpaper
- Drive mappings
- Software deployment
- Printer deployment
- Security settings

CORP-SEC-Password Policy
CORP-USR-Drive Mappings
CORP-CMP-Desktop Settings
CORP-SEC-Windows Firewall
DEPT-FIN-Accounting Software

Right-click GPO > GPO Status > User configuration settings disabled

1. Remove "Authenticated Users"
2. Add specific group (e.g., "Accounting Users")
3. Ensure group has Read and Apply Group Policy permissions

# Example: Only Windows 10/11
SELECT * FROM Win32_OperatingSystem WHERE Version LIKE "10.%" OR Version LIKE "11.%"

# Example: Only laptops
SELECT * FROM Win32_SystemEnclosure WHERE ChassisTypes = "9" OR ChassisTypes = "10"

# Example: Specific IP subnet
SELECT * FROM Win32_NetworkAdapterConfiguration WHERE IPEnabled=TRUE AND IPAddress LIKE "192.168.1.%"

Computer Configuration > Policies > Windows Settings > Security Settings > Account Policies

Password Policy:
- Enforce password history: 24 passwords
- Maximum password age: 90 days
- Minimum password age: 1 day
- Minimum password length: 14 characters
- Password must meet complexity requirements: Enabled
- Store passwords using reversible encryption: Disabled

Account Lockout Policy:
- Account lockout duration: 30 minutes
- Account lockout threshold: 5 invalid attempts
- Reset account lockout counter after: 30 minutes

User Configuration > Policies > Administrative Templates > Control Panel

- Prohibit access to Control Panel and PC settings: Enabled
- Hide specified Control Panel items: Select items

User Configuration > Policies > Administrative Templates > System

- Prevent access to the command prompt: Enabled
- Prevent access to registry editing tools: Enabled
- Remove Task Manager: Enabled (for highly restricted users)

User Configuration > Policies > Windows Settings > Folder Redirection

Documents:
- Basic: Redirect to \\fileserver\users$\%USERNAME%\Documents
- Grant exclusive rights: Enabled
- Move contents: Enabled

Desktop, Pictures, etc:
- Follow the Documents folder

User Configuration > Preferences > Windows Settings > Drive Maps

New Mapped Drive:
- Action: Update (create if doesn't exist, update if does)
- Location: \\fileserver\share
- Label as: Descriptive name
- Drive Letter: H:
- Reconnect: Enabled
- Hide/Show this drive: Show
- Common tab > Item-level targeting: Filter by Security Group

Computer Configuration > Policies > Software Settings > Software installation

New Package:
- Select .msi file from network share
- Deployment method:
  - Assigned: Installs automatically
  - Published: Available in Add/Remove Programs (user config only)

Advanced:
- Deploy to user's language: Enabled
- Uninstall when out of management scope: Optional

Computer Configuration > Policies > Administrative Templates > Windows Components > Windows Update

Configure Automatic Updates:
- Enabled
- Option: 4 - Auto download and schedule install
- Install day: Every day
- Install time: 3:00 AM

Specify intranet Microsoft update service location:
- Enabled (if using WSUS)
- Intranet update service: http://wsus.domain.local:8530
- Intranet statistics server: http://wsus.domain.local:8530

Configure deadline for quality updates: 7 days
Configure deadline for feature updates: 14 days

Computer Configuration > Policies > Windows Settings > Security Settings

Local Policies > Security Options:
- Accounts: Rename administrator account: LocalAdmin
- Interactive logon: Do not display last user name: Enabled
- Network access: Do not allow anonymous enumeration of SAM accounts: Enabled
- Network security: LAN Manager authentication level: NTLMv2 only
- Shutdown: Allow system to be shut down without logon: Disabled

Advanced Audit Policy Configuration:
- Audit Logon: Success, Failure
- Audit Account Logon: Success, Failure
- Audit Object Access: Failure
- Audit Policy Change: Success, Failure
- Audit Privilege Use: Failure

User Configuration > Preferences > Control Panel Settings > Printers

New Shared Printer:
- Action: Update
- Share path: \\printserver\PrinterName
- Common tab > Item-level targeting:
  - Security Group is "Accounting Users"
  - OR Computer Name matches "ACCT-*"

Options:
- Set as default printer: Optional
- Skip local printer: Enabled

Computer Configuration > Preferences > Windows Settings > Registry

New Registry Item:
- Hive: HKEY_LOCAL_MACHINE
- Path: SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters
- Value: SMB1
- Type: REG_DWORD
- Data: 0

Computer Configuration > Policies > Windows Settings > Security Settings > Windows Defender Firewall

Domain Profile:
- Firewall state: On
- Inbound connections: Block
- Outbound connections: Allow

Inbound Rules:
- Create rules for required services (RDP, File Sharing, etc.)
- Scope: Specific IPs when possible

Computer Configuration > Policies > Administrative Templates > Windows Components > BitLocker Drive Encryption

Operating System Drives:
- Require additional authentication at startup: Enabled
  - Allow BitLocker without compatible TPM: Optional
- Configure minimum PIN length: 6
- Choose how BitLocker-protected operating systems can be recovered:
  - Save BitLocker recovery to AD DS: Enabled
  - Do not enable BitLocker until recovery saved: Enabled

Computer Configuration > Policies > Windows Settings > Security Settings > Application Control Policies > AppLocker

Executable Rules:
1. Allow: Administrators - All files
2. Allow: Everyone - \Program Files\*
3. Allow: Everyone - \Windows\*
4. Deny: Everyone - Specific blocked applications

Publisher Rules (better than path rules):
- Allow based on publisher, product, file version

# View applied GPOs
gpresult /r

# Detailed HTML report
gpresult /h C:\gpreport.html

# For remote computer
gpresult /s COMPUTER01 /h C:\gpreport.html

# For specific user
gpresult /s COMPUTER01 /user domain\username /h C:\gpreport.html

# Show only user settings
gpresult /r /scope:user

# Show only computer settings
gpresult /r /scope:computer

# Update all policies
gpupdate /force

# Update only computer policies
gpupdate /target:computer /force

# Update only user policies
gpupdate /target:user /force

# Update and logoff user
gpupdate /force /logoff

# Update and reboot
gpupdate /force /boot

Computer Configuration > Policies > Administrative Templates > System > Group Policy

- Configure Group Policy slow link detection: 0 (treat all as fast links for testing)
- Turn off background refresh: For testing only
- Group Policy processing event logging: Enabled (for all components)

Event Viewer > Applications and Services Logs > Microsoft > Windows > GroupPolicy > Operational

# Check what's preventing GPO
gpresult /r /scope:computer | findstr "Denied"

# Verify AD replication
repadmin /showrepl

# Check GPO replication specifically
dcdiag /test:replications

# Enable detailed logging
Set-ItemProperty -Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name "UserEnvDebugLevel" -Value 0x30002

# Check log
Get-Content C:\Windows\debug\usermode\userenv.log

# Disable specific GPO extension for testing
# (Event Viewer > GP Operational logs show extension GUIDs)

# Backup all GPOs
Backup-Gpo -All -Path "C:\GPOBackup"

# Backup specific GPO
Backup-Gpo -Name "CORP-SEC-Password Policy" -Path "C:\GPOBackup"

# Backup by GUID
Backup-Gpo -Guid {12345678-1234-1234-1234-123456789012} -Path "C:\GPOBackup"

# Include description
Backup-Gpo -Name "CORP-SEC-Password Policy" -Path "C:\GPOBackup" -Comment "Pre-change backup $(Get-Date)"

# Restore specific GPO
Restore-GPO -Name "CORP-SEC-Password Policy" -Path "C:\GPOBackup"

# Restore from backup ID
Restore-GPO -BackupId {12345678-1234-1234-1234-123456789012} -Path "C:\GPOBackup"

# Restore all GPOs
Restore-GPO -All -Path "C:\GPOBackup"

# Copy GPO to another domain
$backupPath = "C:\GPOBackup"
Backup-GPO -Name "Source GPO" -Path $backupPath

# In target domain:
Import-GPO -BackupId {BackupID} -Path $backupPath -TargetName "Imported GPO" -CreateIfNeeded

# Or create migration table for domain/UNC path changes

Example: Map drive only for specific security group on specific subnet

Targeting:
- Security Group is ACCOUNTING
  AND
- IP Address Range: 192.168.10.0 - 192.168.10.255

# Create central store
New-Item -Path "\\domain.com\SYSVOL\domain.com\Policies\PolicyDefinitions" -ItemType Directory

# Copy ADMX files
Copy-Item C:\Windows\PolicyDefinitions\* \\domain.com\SYSVOL\domain.com\Policies\PolicyDefinitions\ -Recurse

# Create starter GPO
New-GPStarterGPO -Name "Security Baseline Template" -Comment "Standard security settings"

# Create GPO from starter GPO
New-GPO -Name "CORP-SEC-Baseline" -StarterGpoName "Security Baseline Template"

# Generate HTML report for all GPOs
Get-GPOReport -All -ReportType HTML -Path "C:\GPOReports\AllGPOs.html"

# Generate XML for single GPO
Get-GPOReport -Name "CORP-SEC-Password Policy" -ReportType XML -Path "C:\GPOReports\PasswordPolicy.xml"

# Generate reports for all GPOs individually
Get-GPO -All | ForEach-Object {
    Get-GPOReport -Guid $_.Id -ReportType HTML -Path "C:\GPOReports\$($_.DisplayName).html"
}

Domain Controllers OU > Audit Policy:
- Audit directory service access: Success

Import-Module GroupPolicy

# Useful cmdlets:
Get-GPO
New-GPO
Set-GPO
Backup-GPO
Restore-GPO
Get-GPOReport
New-GPLink
Remove-GPLink
Set-GPPermission