Chapter 3: Group Policy Processing Behavior

Overview

After you create or modify a GPO in the domain, the policy "wishes" are not immediately dropped on the target machines. In fact, they're not dropped on the target machines at all; they're requested by the client computer at various times throughout the day. GPOs are processed at specific times, based on various conditions.

Indeed, it's likely that you have Windows 2000, Windows XP, and, now, Windows 2003 machines in your environment. Each operating system that receives Group Policy instructions processes Group Policy at different times in different ways. With three operating systems, the expected behaviors can really get confusing quickly.

Additionally, other factors determine when and how a GPO applies. When users dial in over slow links, things can beand usually aredifferent. And you can instruct the Group Policy engine (on specific or all computers) to forgo its out-of-the-box processing behaviors for a customized (and often more secure) way to process.

Also, if you are using Windows 2003's new Cross-Forest Trusts, Group Policy will process differently, depending on each operating system (and service pack) you use; understanding what is going on is paramount.

Often, people throw up their hands when the Group Policy engine doesn't seem to process the GPOs they dictate in an expected manner. Group Policy doesn't just process when it wants to; rather, it adheres to a strict set of processing rules. This chapter's goal is to answer the question, When does Group Policy apply? Understanding the processing rules will help you better understand when Group Policy processes GPOs the way it does. Then, in the next chapter, you'll get a grip on why Group Policy applies. Between these two chapters, your goal is to become a better Group Policy troubleshooter.