Group Policy

Group policy

Organizational unit (O.U)  It is logical container which contain AD objects (Users, groups, OU and other objects)  It is called as subtree  It is used for minimizing administrative task

 It is used for organizing and managing AD objects  It is used for delegating control to one or more user Steps to create O.U

Group policy:  Group policy is collection of setting which can be applied on computers and users  With group policy administrator can easily manage the computers and users  Ease administration using group policy

Group policy can be assigned at three levels: 1) OU level 2) Domain level 3) Site level 1)OU level: If policies are applied at OU level then the policy will be applied to all the object in the OU

Domain level policy: If policies are applied at domain level then policy will be applied to all the objects in domain including administrator Normally system applies domain policy first and then it will apply OU level policy

If any conflict occurs as an example u have removed search option on domain level, but on OU level u have given show search, then in this case OU level policy will win out, coz first policy is applied to domain level, here in this case administrator will not be able to see search on start menu, but OU users will be able to.

Case 1: Domain level: 1) Remove my doc 2) Remove recycle bin OU level: 1) Remove my comp 2) Prevent CMD Result: for all users domain level policies will be applied and for OU users both domain and OU level policies will be applied

Case2) Domain level: 1) Remove my doc 2) Remove my recycle OU level : 1) Remove my comp 2) Prevent CMD 3) Show my doc Result: For all domain users domain level policies will be applied For OU users Remove my recycle, remove my comp, prevent CMD, show my DOC

Note: Whenever there is conflict between two levels then policies will be applied from TOP to bottom and their respective level policies will be applied

Block policy inheritance: It is use to stop inheritance from higher level policy, e.g. domain level policy. After enabling this higher level policy will not affect lower level policy

No override option is used when you have multiple group policy object for one OU and you want that policy mentioned on this OU should not be overwritten by higher prior group policy object OU, GPO-> hide help and support GPO1show help and support use No override option on GPO1, users will be able to access the help and support