# Group Policy for Small and Mid-Size Networks

This is a plain-text copy of a guide published by Ellington Technologies, made for pasting into an AI assistant. It's generated from the same source file as the web page. If the two ever differ, the web page is correct: https://jeremiahellington.com/resources/group-policy-small-mid-size-networks

- Source (authoritative web version): https://jeremiahellington.com/resources/group-policy-small-mid-size-networks
- Author: Jeremiah Ellington
- Published: 2026-10-29
- Last updated: 2026-10-29
- Last reviewed: 2026-10-29
- Next scheduled review: 2027-04-30
- Applies to: Active Directory domains and Windows clients on currently supported Windows Server and Windows versions; check your version's documentation where noted. Checked against Microsoft Learn and the Microsoft Security Baselines on 2026-10-29, not lab-tested.
- Who it's for: Admins of a single-domain network (one to a few sites, up to a few hundred devices) who've used gpedit.msc or inherited a domain and want to manage its Group Policy deliberately.
- Level: Intermediate
- Before you start: Sign-in to a domain controller, or a management PC with the Group Policy Management Console (GPMC) and the GroupPolicy PowerShell module from RSAT; Rights to edit and link GPOs in your domain (Domain Admins by default, or delegated rights on the OUs you manage); A folder for GPO backups that only admins can write to

How Group Policy works in a single Active Directory domain: local and domain policy, processing order, filtering, the Central Store, backup and restore, troubleshooting, and the change-control habits that keep a policy change from becoming an outage.

---

This guide is for anyone looking after Group Policy in one Active Directory domain: a single office or a few sites, up to a few hundred computers. Maybe you've set things in `gpedit.msc` on one PC, or you've inherited a domain full of GPOs nobody can explain. It covers how policy is found and applied, how to manage it with the Group Policy Management Console (GPMC) and PowerShell, how to back it up, how to work out why a setting didn't apply, and the habits that make changes safe.

It doesn't teach Active Directory basics, and it doesn't walk through specific settings. Password policy, Microsoft 365 Apps, security baselines, Windows LAPS, drive maps and Windows Update are planned for a separate recipes guide (not yet published). Every name here is fictional: the domain is `corp.example.com`, and the servers are `dc01` and `fs01`.

> **Important:**
> Checked against Microsoft Learn and the Microsoft Security Baselines on 2026-10-29, not lab-tested. Nothing on this page was run against a domain for this guide. Commands marked **Changes Group Policy** alter live policy: back up your GPOs and link to a pilot OU first, as described in [Change control](https://jeremiahellington.com/resources/group-policy-small-mid-size-networks#change-control-back-up-pilot-then-roll-out). The same applies to the GPMC steps in this guide that change a GPO, its links, its filtering or the Central Store.

## What Group Policy is

A Group Policy Object (GPO) is a named set of settings stored in Active Directory and in the SYSVOL share on your domain controllers. Each GPO has two halves:

- **Computer Configuration** applies to the machine, whoever signs in: firewall rules, power settings, security options. It's applied when the computer starts.
- **User Configuration** applies to the person, on whatever machine they use: drive maps, folder redirection, desktop restrictions. It's applied when the user signs in.

On the client, components called client-side extensions (CSEs) do the work. Each one handles one kind of setting, such as registry-based Administrative Templates, security settings or scripts ([Group Policy overview](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/group-policy/group-policy-overview)).

### Policies and Preferences

Every GPO has a **Policies** section and a **Preferences** section, and they behave differently. Getting this wrong is behind a lot of "why is that setting still there?" puzzles.

| | Policies | Preferences |
| --- | --- | --- |
| Can the user change it? | No. The setting is enforced | Yes, until the next refresh puts it back |
| At each background refresh | By default, reapplied only if something in the GPOs changed (security settings are also reapplied every 16 hours) | Rewritten every time, by default |
| When the GPO stops applying | The setting is removed (most settings; some security settings, such as registry and file-system permissions, can stay and must be changed back explicitly) | The setting stays, unless the item has **Remove this item when it is no longer applied** |

Sources: the [Preferences overview](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn581922(v=ws.11)) (archived documentation) says preference results "are rewritten each time Group Policy refreshes" unless the item is set to **Apply once and do not reapply**, and that the Group Policy service doesn't remove preference settings when the GPO goes out of scope. The [processing page](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/group-policy/group-policy-processing) says that, by default, a client-side extension reapplies policy settings during a refresh only if it detects a change to its GPOs or to its list of GPOs. Microsoft's [security policy settings page](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/administer-security-policy-settings#applying-security-settings) (archived documentation) says a security setting that a policy no longer defines goes back to its previous value, but stays as it is if it had no previous value, and that registry and file settings keep the policy's values until they're set to other values. The page says this is sometimes called "tattooing." Microsoft's [security policy settings overview](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/security-policy-settings) (archived documentation) adds that, by default, security settings delivered by Group Policy are also applied every 16 hours, even if a GPO hasn't changed.

So use a policy when users mustn't change something. Use a preference for a sensible default, such as a mapped drive, and tick **Remove this item when it is no longer applied** if it should go away when the user leaves the group.

## Local and domain policy

Every Windows computer has a **local** Group Policy Object, edited with the Local Group Policy Editor (`gpedit.msc`). It affects only that machine. On a workgroup PC it's the only policy there is.

Once a computer joins a domain, it also gets **domain GPOs**: GPOs linked to the AD site it's in, the domain, and the OUs that hold the computer and user accounts. Local policy is processed first, and settings from domain GPOs override it ([Group Policy processing](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/group-policy/group-policy-processing)). In practice, a domain GPO wins whenever both set the same thing.

For machines that will never join a domain, Microsoft's **LGPO.exe** is a command-line tool for automating local policy. It can import and apply settings from Registry.pol files, security templates and audit backups, and Microsoft describes it as useful for managing non-domain-joined systems ([Security Compliance Toolkit guide](https://learn.microsoft.com/en-us/windows/security/operating-system-security/device-management/windows-security-configuration-framework/security-compliance-toolkit-10)). It's a free download in the [Security Compliance Toolkit](https://www.microsoft.com/en-us/download/details.aspx?id=55319), alongside Policy Analyzer and the security baselines.

## Processing order: LSDOU

GPOs are applied in this order ([Group Policy processing](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/group-policy/group-policy-processing)):

1. **L**ocal GPO.
2. GPOs linked to the **S**ite.
3. GPOs linked to the **D**omain.
4. GPOs linked to **O**Us, parent first, then each child OU down to the one holding the object.

Each step can override the one before, so the container **closest** to the computer or user wins. When several GPOs are linked to the same container, the link with the **lowest link order** (1 beats 2) has precedence.

Here's an example. **Interactive logon: Machine inactivity limit** is a computer setting under Security Options that locks the session after a number of seconds without input (it takes effect after a restart) ([Machine inactivity limit](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/interactive-logon-machine-inactivity-limit), archived documentation). A GPO linked to the domain sets it to 900 seconds. A GPO linked to `OU=Reception,OU=Workstations,DC=corp,DC=example,DC=com` sets 300. Reception PCs lock after 300 seconds, because their OU is closer than the domain.

### When policy is applied

- **Foreground:** computer policy at startup, user policy at sign-in.
- **Background refresh:** every 90 minutes by default, plus a random offset of up to 30 minutes. Domain controllers check for computer policy changes every five minutes.
- **Not everything runs in the background.** Folder redirection runs only at sign-in. Software installation runs only at startup and sign-in. Scripts run only at startup, shutdown, sign-in and sign-off.

All three points are from [Microsoft's processing page](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/group-policy/group-policy-processing). It also explains why a change can take a while to show up. A GPO lives in two places, AD and SYSVOL, and they replicate separately. AD replication between DCs in one site usually takes less than a minute. SYSVOL replication with DFS Replication runs every 15 minutes within a site, and on the site-link schedule between sites.

## Inheritance, Enforced and Block Inheritance

By default, GPOs flow down: a GPO linked to the domain applies to every OU under it. Two switches change that ([Group Policy processing](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/group-policy/group-policy-processing)):

- **Block Inheritance** is a property of a **domain or OU**. It stops GPOs linked higher up (site, domain, parent OUs) from applying to that OU.
- **Enforced** is a property of a **link**. An enforced link's settings can't be overridden by GPOs linked lower down, and it still applies through Block Inheritance.

My advice is to use both rarely. Each one is an exception to the normal "closest wins" rule, and every exception is something the next admin has to discover before they can predict what a computer will get. If you find yourself reaching for Block Inheritance, it's often a sign the OU structure or a GPO's scope needs rethinking.

## Security filtering

Every GPO has a **Security Filtering** list, on its **Scope** tab in GPMC. On a new GPO you'll usually find **Authenticated Users** there, which means the GPO applies to every user and computer in the linked container. Check the list on your own GPOs rather than assuming it. Replace it with a group to target a subset, for example `GG-Finance-Users`. Filtering applies to the whole GPO; you can't filter individual settings inside it ([Group Policy processing](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/group-policy/group-policy-processing)).

> **Warning:**
> If you remove Authenticated Users from a GPO's security filter, user settings in it may stop applying. Since the MS16-072 security update, computers read user policy in the **computer's** security context, not the user's ([Microsoft Support, MS16-072 known issues](https://support.microsoft.com/en-us/servicing/os/windows-server/2016/06/ms16-072-security-update-for-group-policy-june-14-2016)). Microsoft's fix is to give Authenticated Users **Read** permission on the GPO or, if you use security filtering, to give Domain Computers Read. Microsoft's article doesn't say where in GPMC to add it, so check the result on your system: afterwards, the Security Filtering list on the **Scope** tab should still show only the groups you meant to target. If Authenticated Users or Domain Computers shows up there too, that usually means the GPO now applies more widely than you meant; check its Delegation tab. If loopback processing is on in Merge mode, the same Microsoft article (KB3163622) says you also have to add the specific users and computers the GPO is meant for.

## WMI filtering

A WMI filter is a query the client runs during processing. The GPO applies only if the query returns true. Each GPO can have one WMI filter, and one filter can be shared by several GPOs ([Group Policy processing](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/group-policy/group-policy-processing)).

A common use is telling workstations from servers. `Win32_OperatingSystem` has a `ProductType` property: 1 is a workstation, 2 a domain controller, 3 a server ([Win32_OperatingSystem](https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/win32-operatingsystem)). A workstations-only filter looks like this:

*WMI filter query (namespace root\CIMV2): workstations only*

```text
SELECT * FROM Win32_OperatingSystem WHERE ProductType = 1
```

A typo in a filter fails quietly: the query doesn't return true, so the GPO just doesn't apply. I'd run the same query on a test machine before attaching it to a GPO:

*Read-only: test the query on the target machine*

```powershell
Get-CimInstance -Query "SELECT * FROM Win32_OperatingSystem WHERE ProductType = 1"
```

If it returns an object, the filter would pass on that machine. If it returns nothing, it wouldn't. In a small domain, an OU per machine type usually does the same job without a query, so I'd keep WMI filters for cases OUs can't express.

## Loopback processing

Normally, user settings come from GPOs linked to the user's OU. **Loopback processing** makes the user settings depend on the **computer** instead. It's meant for shared, closely managed machines: kiosks, reception PCs, classrooms and Remote Desktop hosts. You turn it on with **Configure user Group Policy loopback processing mode** under Computer Configuration\Policies\Administrative Templates\System\Group Policy ([Group Policy processing](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/group-policy/group-policy-processing)).

- **Merge:** the user's normal GPOs apply, then the computer's GPOs are added on top with higher precedence. Where they conflict, the computer's GPOs win.
- **Replace:** only the computer's GPOs are used for user settings. The user's normal GPOs are ignored on that machine.

Microsoft's [loopback article](https://learn.microsoft.com/en-us/troubleshoot/windows-server/group-policy/loopback-processing-of-group-policy) has the detail. Put loopback in its own GPO, linked only to the OU that holds those shared machines, so it can't spread to ordinary PCs. Microsoft's processing page also says that with loopback on, both the Computer Configuration and User Configuration halves of the GPO must be enabled, so don't disable either half of a GPO that loopback relies on.

## Managing GPOs with GPMC

GPMC (`gpmc.msc`) is where you'll do most of the work. It comes with Windows Server, and you can add it to a management PC with RSAT. To link a GPO you need permission on the site, domain or OU it's linked to. By default only Domain Admins and Enterprise Admins have that ([Group Policy Management Console](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/group-policy/group-policy-management-console)).

The order I'd work in for a new GPO. These steps change Group Policy, so run [Back up before every change](https://jeremiahellington.com/resources/group-policy-small-mid-size-networks#back-up-before-every-change) first:

1. **Create it unlinked**, under **Group Policy Objects**, not by right-clicking an OU. An unlinked GPO does nothing, so you can edit it safely.
2. **Edit it**, and fill in only the half you need.
3. **Disable the unused half.** On the GPO's **Details** tab, set **GPO Status** to "User configuration settings disabled" (or computer). Microsoft suggests this because the client then doesn't scan that half ([Group Policy processing](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/group-policy/group-policy-processing)).
4. **Link it to a pilot OU**, check it, then link it where it belongs.
5. **Set the link order** if more than one GPO on that container touches the same settings.

**Unlinking** removes the GPO from one container and leaves the GPO itself intact. **Deleting** removes the GPO itself, so it stops applying everywhere it was linked. Unlink first, wait, and delete later.

The same first steps in PowerShell, with the GroupPolicy module. Run [Back up before every change](https://jeremiahellington.com/resources/group-policy-small-mid-size-networks#back-up-before-every-change) before you run them:

*Changes Group Policy: create an unlinked GPO, then link it to the pilot OU*

```powershell
New-GPO -Name "C-Workstations-ScreenLock" -Comment "Screen lock after 10 min. Change ref CHG-0001."
New-GPLink -Name "C-Workstations-ScreenLock" -Target "OU=Pilot,OU=Workstations,DC=corp,DC=example,DC=com" -LinkEnabled Yes
```

[New-GPO](https://learn.microsoft.com/en-us/powershell/module/grouppolicy/new-gpo?view=windowsserver2025-ps) creates an empty GPO and takes an optional comment. [New-GPLink](https://learn.microsoft.com/en-us/powershell/module/grouppolicy/new-gplink?view=windowsserver2025-ps) links it, and also has `-Order` and `-Enforced` parameters.

## The Central Store

Administrative Templates are the `.admx` and `.adml` files that describe registry-based settings to the editor. Without a **Central Store**, each admin PC uses its own local copies in `C:\Windows\PolicyDefinitions`. Admins on different Windows versions then see different sets of settings in the same GPO.

A Central Store is a `PolicyDefinitions` folder in SYSVOL. Once it exists, the editor uses it instead of local files, and it replicates to every DC with SYSVOL. For this guide's example domain the path is:

*Central Store path in the example domain*

```text
\\corp.example.com\SYSVOL\corp.example.com\Policies\PolicyDefinitions
```

You create it once, by copying the `PolicyDefinitions` folder from a current Windows machine or from Microsoft's downloaded templates. After that, you add templates to it for other products. [Microsoft's Central Store article](https://learn.microsoft.com/en-us/troubleshoot/windows-client/group-policy/create-and-manage-central-store) has the steps, including how to build a new store when you already have one. Microsoft's method builds the new store in a separately named folder and keeps the old one, so you can switch back if the new templates cause a problem.

> **Caution:**
> Microsoft supports the downloaded ADMX packages only in the Central Store. Replacing the files in `C:\Windows\PolicyDefinitions` with a downloaded package isn't supported ([Central Store article](https://learn.microsoft.com/en-us/troubleshoot/windows-client/group-policy/create-and-manage-central-store)).

Microsoft 365 Apps settings come from the Office templates, a separate free download: [Administrative Template files (ADMX/ADML) for Microsoft Office](https://www.microsoft.com/en-us/download/details.aspx?id=49030). The download page covers Microsoft 365 Apps for enterprise, Office LTSC 2024 and 2021, Office 2019 and Office 2016. Add those files to the Central Store too. Then they show up for every admin, whichever PC they edit from.

## Back up and restore

### What a backup holds, and what it doesn't

A GPMC backup or a `Backup-GPO` backup writes a GPO to a folder. When you restore it, you get back the GPO's original ID, its settings and its permissions ([GPO operations supported by the GPMC](https://learn.microsoft.com/en-us/previous-versions/windows/desktop/gpmc/gpo-operations-supported-by-the-gpmc), archived documentation). **Links aren't part of that.** In Microsoft's words: "A restore operation cannot modify links to the GPO because links are attributes of the scope of management (SOM), which is a site, domain, or organizational unit (OU)." The same page says an import doesn't modify links or the WMI filter, and a copy creates a new GPO with a new ID. Microsoft's current [backup and restore page](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/group-policy/group-policy-backup-restore) agrees that an import "doesn't modify the existing security filtering or links on the destination GPO" and that a copy always creates a new GPO, but it doesn't mention links for a restore. So after any restore, compare the GPO's **Scope** tab with your record of its links.

In practice:

- If you restore an **existing** GPO to an earlier version, its current links stay as they are.
- If someone **unlinked** a GPO, restoring it won't relink it. You need a record of where it was linked.
- If you **import** settings into a new GPO, or copy one, you have to link it yourself.

So record links alongside every backup. [Get-GPInheritance](https://learn.microsoft.com/en-us/powershell/module/grouppolicy/get-gpinheritance?view=windowsserver2025-ps) lists the GPOs linked directly to a domain or OU (its `GpoLinks` property). It doesn't cover sites, so check any site links in GPMC under **Sites**.

### Back up before every change

*Writes backup files; doesn't change Group Policy: back up every GPO in the domain*

```powershell
$stamp = Get-Date -Format "yyyy-MM-dd_HHmm"
$path  = "\\fs01.corp.example.com\GPOBackups\$stamp"
New-Item -ItemType Directory -Path $path | Out-Null
Backup-GPO -All -Path $path -Comment "Before CHG-0001"
```

*Writes links.csv; doesn't change Group Policy: record the links on the domain and every OU next to the backup*

```powershell
$targets = @("DC=corp,DC=example,DC=com") + (Get-ADOrganizationalUnit -Filter * | ForEach-Object DistinguishedName)
$targets | ForEach-Object {
    $t = $_
    (Get-GPInheritance -Target $t).GpoLinks |
        Select-Object @{n='Target';e={$t}}, DisplayName, Enabled, Enforced, Order
} | Export-Csv -Path "$path\links.csv" -NoTypeInformation
```

The second block needs the ActiveDirectory module for `Get-ADOrganizationalUnit`. [Backup-GPO](https://learn.microsoft.com/en-us/powershell/module/grouppolicy/backup-gpo?view=windowsserver2025-ps) with `-All` backs up every GPO in the domain, and the comment is saved with each backup. Microsoft says not to work with the backup files directly through the file system; use GPMC or the cmdlets to read and restore them ([backup and restore](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/group-policy/group-policy-backup-restore)).

### Restore a GPO

> **Warning:**
> A restore overwrites the GPO's current settings and permissions with the backup's, for every computer and user it's linked to. Back up the current state first, so you can undo the restore, and check the backup's date and comment before you run it.

*Changes Group Policy: restore one GPO from its most recent backup in the folder*

```powershell
Restore-GPO -Name "C-Workstations-ScreenLock" -Path "\\fs01.corp.example.com\GPOBackups\2026-10-29_0900"
```

[Restore-GPO](https://learn.microsoft.com/en-us/powershell/module/grouppolicy/restore-gpo?view=windowsserver2025-ps) restores to the domain the backup came from. It fails if that domain isn't available or **if the GPO no longer exists in the domain**. To bring back a GPO that was deleted, use GPMC: right-click **Group Policy Objects**, choose **Manage Backups**, pick the backup and select **Restore** ([backup and restore](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/group-policy/group-policy-backup-restore)). Then put its links back from your `links.csv`.

## Modelling and results: what would apply, and what did

GPMC has two reports that answer different questions ([Group Policy Modeling and Results](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/group-policy/group-policy-modeling-results)):

- **Group Policy Modeling** simulates what *would* apply to a user and computer in given OUs. Use it before you move an account or link a GPO.
- **Group Policy Results** shows what *did* apply on a real machine at its last refresh. Use it when a setting isn't where you expect.

On the client itself:

*Writes a report file; doesn't change Group Policy: in an elevated prompt on the affected PC*

```powershell
gpresult /r /scope computer
gpresult /h C:\Temp\gpresult.html /f
```

`/r` prints a summary of the resultant set of policy (RSoP), and `/scope computer` limits it to the computer half. `/h` saves the full report as HTML, and `/f` overwrites the file if it's already there ([gpresult](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/gpresult)). Create the folder first if it isn't there. Microsoft's [troubleshooting guide](https://learn.microsoft.com/en-us/troubleshoot/windows-server/group-policy/applying-group-policy-troubleshooting-guidance) runs `gpresult /h` from an elevated command prompt, and says the report gives an error explaining why a GPO isn't being applied. In GPMC, the **Group Policy Results** report shows, under **Winning GPO**, which GPO is responsible for each setting ([Group Policy Modeling and Results](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/group-policy/group-policy-modeling-results)). From PowerShell, [Get-GPResultantSetOfPolicy](https://learn.microsoft.com/en-us/powershell/module/grouppolicy/get-gpresultantsetofpolicy?view=windowsserver2025-ps) writes the same information to a file with `-ReportType Html -Path <file>`.

To pick up a change without waiting for the next refresh:

*Refreshes policy on one PC; doesn't change any GPO*

```powershell
gpupdate /force
```

`gpupdate` on its own applies only settings that have changed. `/force` reapplies all of them ([gpupdate](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/gpupdate)). For a remote computer, [Invoke-GPUpdate](https://learn.microsoft.com/en-us/powershell/module/grouppolicy/invoke-gpupdate?view=windowsserver2025-ps) schedules a refresh. Its `-RandomDelayInMinutes` parameter spreads the load when you target many machines. You can also right-click an OU in GPMC and choose **Group Policy Update**.

## Troubleshooting a setting that doesn't apply

Work from the outside in:

1. **Is the GPO in scope?** Run `gpresult /h` on the PC and find the GPO in the report. Microsoft says the report gives an error explaining why a GPO isn't being applied, and that the Group Policy Operational log lists the applied GPOs and the denied GPOs, with the reason for each denial ([troubleshooting guide](https://learn.microsoft.com/en-us/troubleshoot/windows-server/group-policy/applying-group-policy-troubleshooting-guidance)). Check the causes this guide covers: security filtering, a WMI filter, a disabled link and a disabled half.
2. **Is the account in the OU you think it is?** Computer settings follow the computer's OU, and user settings follow the user's OU, unless loopback is on.
3. **Did something closer win?** The Winning GPO heading in GPMC's Group Policy Results report answers this. Look for a GPO linked lower down, a lower link order, or an Enforced link higher up.
4. **Did the client process policy at all?** Check the Group Policy Operational log, `Microsoft-Windows-GroupPolicy/Operational`, in Event Viewer. Microsoft's [troubleshooting guide](https://learn.microsoft.com/en-us/troubleshoot/windows-server/group-policy/applying-group-policy-troubleshooting-guidance) shows how to find the Activity ID of one processing run and filter the log down to it. Running `gpupdate` starts a new run with a new Activity ID, so update the filter afterwards.
5. **Does one site or one DC see an old version?** Then suspect AD or SYSVOL replication between DCs, not the GPO. The [DC migration runbook's replication checks](https://jeremiahellington.com/resources/domain-controller-migration-runbook#phase-5-validate-replication) cover how to test it.

## Change control: back up, pilot, then roll out

Once a change has replicated, every machine in scope picks up most of it at its next background refresh, by default within about two hours, without anyone touching it. Folder redirection, software installation, scripts and settings that need a restart wait for the next startup or sign-in. That's the point, and it's also the risk. These are the habits I'd keep for every change, however small:

1. **Back up all GPOs and record the links** ([above](https://jeremiahellington.com/resources/group-policy-small-mid-size-networks#back-up-before-every-change)).
2. **Make the change in a new or copied GPO, or note the exact before and after values** if you must edit an existing one.
3. **Link to a pilot OU first.** For example, create `OU=Pilot,OU=Workstations,DC=corp,DC=example,DC=com` and move two or three willing users' PCs into it. For a user-side change, such as a drive map, also move two or three test or willing user accounts into a pilot users OU, such as `OU=Pilot,OU=Users,DC=corp,DC=example,DC=com`, because user settings follow the user's OU unless [loopback](https://jeremiahellington.com/resources/group-policy-small-mid-size-networks#loopback-processing) is on ([Group Policy processing](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/group-policy/group-policy-processing)). Run `gpupdate /force` there, restart or sign out and back in if the setting only applies at startup or sign-in, confirm with `gpresult`, and give it a day of normal work.
4. **Then link it where it belongs**, and check one machine in each affected OU.
5. **Write down what you did**: the GPO name, what changed, why, when, and the backup folder. A plain text change log next to the backups is enough.

Two naming habits make all of this easier (my convention, not Microsoft's):

- **Name GPOs by scope and purpose**, for example `C-Workstations-Baseline` for a computer-side GPO or `U-Finance-DriveMaps` for a user-side one. Anyone reading the list in GPMC can tell what a GPO is for without opening it.
- **Use the GPO comment** for the reason and a change reference. `New-GPO -Comment` sets it, and it's on the **Details** tab in GPMC.

## Best practices

- **Leave the two default GPOs for their jobs.** Microsoft's guidance is to use the Default Domain Policy only for account policies (password, account lockout and Kerberos policy) and the Default Domain Controllers Policy only for user rights and audit policies ([dcgpofix](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/dcgpofix)). Everything else goes in GPOs of your own.
- **One job per GPO, within reason.** In my view, a GPO named for one purpose is easier to test, roll back and explain than an "everything" GPO. Microsoft's processing page also suggests combining small GPOs, since fewer GPOs means faster sign-ins and simpler troubleshooting. So group settings that always change together, and keep unrelated ones apart.
- **Disable the half you don't use**, so clients skip it.
- **Keep Enforced, Block Inheritance and WMI filters rare.** Each is an exception someone has to find later.
- **Test, then stage.** Pilot OU first, every time.
- **Treat `dcgpofix` as a last resort.** It recreates the Default Domain Policy and Default Domain Controllers Policy, restores only their own settings, and is intended only for disaster recovery of those two GPOs. It doesn't restore any GPO you created ([dcgpofix](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/dcgpofix)). Restore from your own backups first.
- **Compare against Microsoft's baselines before you invent settings.** The [security baselines](https://learn.microsoft.com/en-us/windows/security/operating-system-security/device-management/windows-security-configuration-framework/windows-security-baselines) are Microsoft-recommended configurations. Policy Analyzer, in the same toolkit, compares sets of GPOs and highlights differences and conflicts without changing anything.

## Where the cloud fits

Domain GPOs reach computers through their site, domain and OU membership, so they only apply to machines joined to your AD domain. Microsoft says Group Policy isn't supported on devices joined only to Microsoft Entra ID (Microsoft Entra joined), because they aren't connected to on-premises AD, and that those devices are managed only through MDM, such as Microsoft Intune ([Plan your Microsoft Entra join deployment](https://learn.microsoft.com/en-us/entra/identity/devices/device-join-plan)). If you're planning a move to Intune, **Group Policy analytics** in Intune imports your existing GPOs and shows which settings have an equivalent there, which are deprecated, and which aren't available ([Group Policy analytics](https://learn.microsoft.com/en-us/intune/device-configuration/import-group-policy-analytics)). It works from XML reports you save from GPMC with **Save report** and import into your Intune tenant, so it's a way to see how much of your Group Policy would carry over without editing any GPO.

The [Microsoft 365 small-office guide](https://jeremiahellington.com/resources/microsoft-365-small-office-guide) covers the tenant side.

## Next steps

- Build the habits first: set up the backup folder, run a full backup and links export, and create a pilot OU.
- Put the Central Store in place if you don't have one, with current Windows and Office templates.
- Run a Group Policy Results report in GPMC for one workstation and one server, and read the Winning GPO for each setting. It's the quickest way to learn what your domain actually does.
- For the commands in one place, see the Active Directory PowerShell cheat sheet and [PowerShell Essentials](https://jeremiahellington.com/resources/cheatsheets/powershell-essentials).

---

## Sources and official documentation

- [Microsoft Learn: Group Policy overview](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/group-policy/group-policy-overview)
- [Microsoft Learn: Group Policy processing](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/group-policy/group-policy-processing)
- [Microsoft Learn: Loopback processing of Group Policy](https://learn.microsoft.com/en-us/troubleshoot/windows-server/group-policy/loopback-processing-of-group-policy)
- [Microsoft Learn: Group Policy Management Console](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/group-policy/group-policy-management-console)
- [Microsoft Learn: Create and manage the Central Store for Group Policy Administrative Templates](https://learn.microsoft.com/en-us/troubleshoot/windows-client/group-policy/create-and-manage-central-store)
- [Microsoft Learn: Back up, restore, migrate, and copy Group Policy Objects](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/group-policy/group-policy-backup-restore)
- [Microsoft Learn (previous versions): GPO operations supported by the GPMC](https://learn.microsoft.com/en-us/previous-versions/windows/desktop/gpmc/gpo-operations-supported-by-the-gpmc)
- [Microsoft Learn: Group Policy Modeling and Group Policy Results](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/group-policy/group-policy-modeling-results)
- [Microsoft Learn: Applying Group Policy troubleshooting guidance](https://learn.microsoft.com/en-us/troubleshoot/windows-server/group-policy/applying-group-policy-troubleshooting-guidance)
- [Microsoft Learn: Security Bulletin MS16-072](https://learn.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-072)
- [Microsoft Support: MS16-072 security update for Group Policy (known issues)](https://support.microsoft.com/en-us/servicing/os/windows-server/2016/06/ms16-072-security-update-for-group-policy-june-14-2016)
- [Microsoft Learn (previous versions): Group Policy Preferences](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn581922(v=ws.11))
- [Microsoft Learn (previous versions): Interactive logon: Machine inactivity limit](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/interactive-logon-machine-inactivity-limit)
- [Microsoft Learn: GroupPolicy module](https://learn.microsoft.com/en-us/powershell/module/grouppolicy/?view=windowsserver2025-ps)
- [Microsoft Learn: Backup-GPO](https://learn.microsoft.com/en-us/powershell/module/grouppolicy/backup-gpo?view=windowsserver2025-ps)
- [Microsoft Learn: Restore-GPO](https://learn.microsoft.com/en-us/powershell/module/grouppolicy/restore-gpo?view=windowsserver2025-ps)
- [Microsoft Learn: Get-GPInheritance](https://learn.microsoft.com/en-us/powershell/module/grouppolicy/get-gpinheritance?view=windowsserver2025-ps)
- [Microsoft Learn: New-GPO](https://learn.microsoft.com/en-us/powershell/module/grouppolicy/new-gpo?view=windowsserver2025-ps)
- [Microsoft Learn: New-GPLink](https://learn.microsoft.com/en-us/powershell/module/grouppolicy/new-gplink?view=windowsserver2025-ps)
- [Microsoft Learn: Get-GPOReport](https://learn.microsoft.com/en-us/powershell/module/grouppolicy/get-gporeport?view=windowsserver2025-ps)
- [Microsoft Learn: Get-GPResultantSetOfPolicy](https://learn.microsoft.com/en-us/powershell/module/grouppolicy/get-gpresultantsetofpolicy?view=windowsserver2025-ps)
- [Microsoft Learn: Invoke-GPUpdate](https://learn.microsoft.com/en-us/powershell/module/grouppolicy/invoke-gpupdate?view=windowsserver2025-ps)
- [Microsoft Learn: gpresult](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/gpresult)
- [Microsoft Learn: gpupdate](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/gpupdate)
- [Microsoft Learn: dcgpofix](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/dcgpofix)
- [Microsoft Learn: Win32_OperatingSystem class (ProductType)](https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/win32-operatingsystem)
- [Microsoft Learn: Microsoft Security Compliance Toolkit guide (Policy Analyzer, LGPO)](https://learn.microsoft.com/en-us/windows/security/operating-system-security/device-management/windows-security-configuration-framework/security-compliance-toolkit-10)
- [Microsoft Learn: Security baselines guide](https://learn.microsoft.com/en-us/windows/security/operating-system-security/device-management/windows-security-configuration-framework/windows-security-baselines)
- [Microsoft Download Center: Microsoft Security Compliance Toolkit 1.0](https://www.microsoft.com/en-us/download/details.aspx?id=55319)
- [Microsoft Download Center: Administrative Template files (ADMX/ADML) for Microsoft Office](https://www.microsoft.com/en-us/download/details.aspx?id=49030)
- [Microsoft Learn: Import and analyze group policies in Intune (Group Policy analytics)](https://learn.microsoft.com/en-us/intune/device-configuration/import-group-policy-analytics)
- [Microsoft Learn: Plan your Microsoft Entra join deployment](https://learn.microsoft.com/en-us/entra/identity/devices/device-join-plan)

## Review history

- Technical review: Jeremiah Ellington, 2026-10-29
- Editorial review: Jeremiah Ellington, 2026-10-29