Understanding Gpos

By Author: Mike Jones
Total Articles: 255
Comment this article

To create a specific desktop configuration for users, you create windows 7 configuration, which are collections of Group Policy settings. Each computer running Microsoft Windows Server 2003 has one local GPO and can, in addition, be subject to any number of nonlocal (Active Directory-based) GPOs.
Local GPOs
One local GPO is stored on each computer whether or not the computer is part of an Active Directory environment or a networked environment. A local GPO affects only the computer on which it is stored. However, because the local GPO settings can be overridden by nonlocal GPOs, the local GPO is the least influential if the computer is in an Active Directory environment. In a non-networked environment (or in a networked environment lacking a Microsoft Windows 2000 or Windows Server 2003 domain controller), the local GPO's settings are more important because they are not overridden by nonlocal GPOs. By default, only nodes under Security Settings are configured for local GPOs; settings in other parts of a local GPO's namespace are not enabled or disabled. The local GPO is stored in MCITP ...
... GroupPolicy.
Nonlocal GPOs
Nonlocal GPOs are created in Active Directory and must be linked to a site, domain, or OU in order to be applied to either users or computers. To use nonlocal GPOs, you must have a Windows 2000 or Windows Server 2003 domain controller installed. By default, when Active Directory directory service is set up, two nonlocal GPOs are created:
Default Domain Policy This GPO is linked to the domain, and it affects all users and computers in the domain (including computers that are domain control?
lers) through Group Policy inheritance. For more information, refer to the section on Group Policy inheritance later in this lesson.
Default Domain Controllers Policy This GPO is linked to the Domain Controllers OU, and it generally affects only domain controllers, because computer
accounts for domain controllers are kept exclusively in the Domain Controllers OU.
Nonlocal GPOs are stored in %Systemroot%\Sysvo\\Domain Name\￥o\icies\GPO GUID\Adm, where GPO GUID is the GPO's globally unique identifier. This lesson discusses nonlocal GPOs unless otherwise specified.
GPOs can be applied only to Microsoft Windows XP Professional, Microsoft Windows 2000, and Windows Server 2003 and are not supported
Microsoft exam for Microsoft Windows 95, Microsoft Windows 98, Microsoft Windows Millennium Edition (Windows Me), or Microsoft Windows NT.