Summary

Group policy gives a network administrator incredible power over the settings on the network. With group policy, applications can be installed and removed from workstations, Registry entries can be modified, scripts can be assigned and run, and folders can be redirected to alternate locations. The settings that control these network features are collected into group policy objects that are linked to objects in Active Directory that determine how the policy will be applied. Policies are always applied in the same order: Local, Site, Domain, and OU. If multiple OUs are present between the user or computer object, policies attached to the OUs closest to the Domain object are processed first, and those attached closest to the user or computer objects are processed last. When different GPOs have conflicting settings, the settings from the last GPO processed are the ones that apply. GPOs can be filtered by WMI filters and security group filters to give greater granular control over where policy elements are applied.

SBS provides several tools in the Server Management Console to help you manage group policy. The Group Policy Management Console snap-in appears under the Advanced Management node in Server Management. In this console, you can quickly view the properties of each GPO, including the settings contained within. GPOs are edited with the Group Policy Object Editor, which is invoked by right-clicking on a GPO and selecting Edit. The GPMC also contains the Group Policy Modeling and Results Wizards, which can help you plan and troubleshoot group policy in the network.

Troubleshooting group policy is most effectively done with the Group Policy Modeling and Results Wizards. The gpresult and gpupdate command-line tools can also be used to help diagnose group policy problems.