Group Policy Structures

by Michael Day

Group Policy implementation is a very important part of the Windows 2000 Active Directory.  True, a Windows 2000 Domain can exist and run fairly smoothly without ever needing to look at applying Group Policies but they are available to make your life easier as a Network Administrator.  This article will start to explain the structures of Group Policies and will be followed by a subsequent article providing examples of some group policies.

Group Policy implementation is a very important part of the Windows 2000 Active Directory.

 Note:  Group Policies only apply to Windows 2000 Computers.  If you have Windows 9x or NT you need to use the System Policy Editor, which I will discuss in a future article.

Using Group Policies you can restrict user access to files and programs they shouldn't need to access like most of the control panel (IE. the System Applet).  You can also use them to distribute software and updates to all the users or computers that need to use them, which will lessen the amount of time you spend going to the individual desks.  Also provided is the ability to configure Microsoft Internet Explorer settings like the default home page (which can be locked to standardize the browsers), custom toolbar images, default favorites (like suppliers websites), and many others.

Group Policy Inheritance

Group Policies are applied in the following order,  the last one applied can overwrite policies from any level above.

  The Default Order is:

Local System Policies (created on the individual machine)
First Organizational Unit (OU)
Second OU, and so on down to the OU the Computer or User is in.

Note upper level policies (Domain, First OU) can be blocked by lower level policies so that they won't get applied to some OU's.  I am using policy blocking to prevent the default user policy to apply to members of the IS Department who need to be able to run all applications for diagnosing problems.

The more Group Policies that apply to a computer or user though the slower the bootup or logon will be.  Microsoft recommends setting the domain policy to only those items that will be applied to everyone and creating OU policies for items that vary by departments or offices.


Group Policies are separated into two main areas, Computer and User.

The Computer policies are applied when the machine boots up and a specified intervals during operation.  One part of the Computer policy is the startup and shutdown scripts which will run a normal script file whenever the computer is started or shutdown.  This could be used to map network drives before the user signs on if there is a common set of drives mapped.

The User policies are applied when the user logs on and again at specified intervals during operations.  Also the User policy allows you to define logon and logoff scripts which could be used to replace or augment the user based scripts that have been available since Windows NT.

The default interval for policy refreshing is 90 minutes give or take 30 minutes (60-120 minutes) but that is configurable within the policies themselves.


Important exceptions to standard policies

Here are some Important exceptions to the normal order of group policies.

First, certain policies can only be applied at the domain level yet are available to select at all levels.  These are Account Policies/Password Policy and Account Policies/Account Lockout Policy.  This means that you can't have special Account Policies for different Departments.

Second, higher level policies can be set with No Override which will force that policy to be applied regardless of what the lower level policies say.

Third, by default policies are applied to all users in the OU that they exist in but you can modify the security settings to just apply to specific users or groups.  How to do this is explained in the article How to apply Group Policies to Groups instead of OU's.

How to create a new Policy

Creating a new group policy is a vary simple and straightforward process.  First you need to have a Windows 2000 Domain Controller, this will not work in a Windows NT domain.  Second you need to have Read and Write access to the Sysvol Share and Modify Access to the Active Directory Container Object. 

Assuming you have filled those requirements, you need to start Active Directory Users and Computers.  Then right click on the Domain or OU you want to create the policy for, select the Group Policy Tab and click on create (to create a brand new policy) or click on the existing policy and click on edit to modify it.  If you are creating a brand new policy you need to give it a meaningful name.  My policy for the Terminal Services in Edmonton is call EdmTermServer, Calgary's is called CalTermServer. 

You have the option to only use the User part of the policy, the Computer part of the policy or both parts of the policy.  If you are only going to edit one section you will find some performance improvement by removing the unused portion (User or Computer)

All that is left to do is define what areas of the policy are applied and what parts are ignored.

What happens when a policy is removed?

Unlike the System Policies in Windows NT or Windows 9x, if you decide that a part of your group policy is no longer desired all you need to do is go in and unselect that portion and it will no longer be applied.  In the System Policies you needed to set it to the exact opposite of what is was to remove it.

This article was originally published on Jan 15, 2001
Page 1 of 1

Thanks for your registration, follow us on our social networks to keep up-to-date