Learn Active Directory - Common Group Policy Settings

#Introduction

Episode 9 gave you the machine — how Group Policy works. Episode 10 fills it with fuel: the settings most often used in the real world. From the password policy that protects the domain, auditing that records the trail, software deployment that saves hours, to drive mapping and printers that put a smile on users' faces.

We'll cover security settings (password policy, account lockout, audit), where each setting lives in the Computer or User Configuration branch, software deployment via GPO, folder redirection, scripts, drive mapping, printers, and loopback processing for kiosk scenarios.

#Computer vs User Configuration: A Location Map

Before diving in, understand where settings live:

Why is password policy in Computer Configuration? Because password policy is enforced by the domain controller (a computer), not by the user. This is a good example of why choosing the right branch matters — you won't find password policy under User Configuration.

#Security Settings: Password and Account Lockout

These are the most fundamental security settings in a domain. They live under Account Policies:

Long passwords beat frequently changed ones: a minimum length policy of 12-16 characters is far more effective against brute force attacks than changing an 8-character password every month. Account lockout prevents password-guessing attacks, but don't make it too strict — a threshold of 3 attempts with a long duration can trigger a denial of service for your own users. To test changes, run gpupdate /force on the client. In episode 11 we'll see how different policies can be applied to different groups.

#Audit Policies

Auditing determines what gets recorded in the Security event log. The most useful categories:

Rule of thumb: enable auditing for Success and Failure on account management and account logon — the overhead cost is small and the value is enormous during incident investigation. For more modern systems, use Advanced Audit Policy, which is far more granular than the classic categories, and verify the status via auditpol /get. Auditing without routine review only leaves behind a bloated log — pair it with monitoring (the topic of episode 23).

#User Rights and Security Options

Still under Security Settings: User Rights Assignment governs who may perform privileged actions like Log on locally, Shut down the system, or Access this computer from the network. Security Options govern system behavior, such as disabling the Administrator account or enforcing UAC. Both must be changed with full understanding — a mistake here can lock down the entire system.

#Software Deployment via GPO

GPO can install MSI-based software to many computers at once. Two deployment models:

• Assigned — software is installed automatically (appears in the Start Menu, installation runs when needed).
• Published — software appears as an option users can install via Add or Remove Programs.

Software deployment suits applications rolled out to the whole organization that rarely change. The limitation: applications must be MSI-based (or have an MSI transform), and modern application management tends to move to tools like Intune or SCCM. For simple deployments, GPO remains a reliable weapon.

#Folder Redirection

Folder Redirection moves user folders (Documents, Desktop, Downloads) to a network share. The benefits:

• Files are stored centrally and easy to back up.
• Users moving to a new machine still see the same files.
• Combined with Offline Files, files remain accessible without a network.

Don't confuse it with roaming profiles: roaming profiles sync the entire profile (including registry) to a server — heavy and fragile; folder redirection only moves specific folders — light and more resilient. For most organizations, folder redirection makes more sense than a full roaming profile.

#Scripts

GPO supports scripts that run at specific points:

A classic logon script connects network drives. Example PowerShell script:

New-PSDrive -Name "P" -PSProvider FileSystem -Root "\\fileserver\Proyek" -Persist -Scope Global

Caution: logon scripts add to login time and run in the user's context. The New-PSDrive cmdlet in the example above maps the drive persistently so it reconnects after a reboot. Replace scripts with Group Policy Preferences when the same result can be achieved without a script — preferences are faster and easier to debug.

#Drive Mapping

Network drive mapping is better done via Group Policy Preferences > Drive Maps these days, not logon scripts:

• Can target specific users with Item-Level Targeting.
• The Reconnect at logon option makes the drive reappear at every login.
• Faster and more readable than scripts.

A common pattern: drive P for a shared project folder, drive H for each user's private home directory. Use clear, consistent names so users don't get confused.

#Printer Deployment

Printers can be deployed via GPO in two ways: Deployed Printers under Computer/User Configuration (locked down, system-managed), or Preferences > Printers (defaults users can change). Item-Level Targeting lets a Surabaya office printer apply only to users in the Surabaya OU. This eliminates the manual "install the printer" work that burdens the helpdesk.

#Loopback Processing

Loopback processing is a special mode that applies User Configuration settings based on the computer, not the user. Two modes:

• Merge — user settings from user GPOs still apply, plus those from the computer.
• Replace — the loopbacked user settings from the computer's GPOs replace the settings from user GPOs.

When is it used? Kiosk scenarios: a lobby computer must display a restricted menu regardless of which account logs in. Without loopback, every user brings their own settings; with loopback replace, the computer "forces" its settings. Enable it via Computer Configuration > Administrative Templates > System > Group Policy > User Group Policy loopback processing mode.

#Conclusion

Episode 10 equips you with the most frequently used settings: security settings with password and account lockout policy, audit policy that records the trail, user rights and security options, software deployment in the assigned and published models, folder redirection compared against roaming profiles, scripts at four lifecycle points, drive mapping via preferences, printer deployment, and loopback processing for special scenarios.

Key takeaways:

• Password policy lives in Computer Configuration because it's enforced by the DC.
• Auditing without routine review is useless.
• Preferences (with item-level targeting) are lighter than scripts.
• Use loopback processing for kiosk and shared-computer scenarios.

All the security settings in this episode — password, lockout, audit — actually share a limitation: they apply uniformly to the whole domain. In episode 11 we discuss the solution: Fine-Grained Password Policies, which allow different password policies for different groups of users. See you in episode 11!