This Windows Server 2022 Tutorial covers how to Configure Group Policy on Windows Server 2022. Group Policy is a feature of the Microsoft Windows NT family of operating systems that controls the working environment of user accounts and computer accounts. It provides centralized management and configuration of operating systems, applications, and users’ settings in an Active Directory environment. A Group Policy Object (GPO) is a virtual collection of policy settings. A GPO has a unique name, such as a GUID, A GPO can represent policy settings in the file system and in the Active Directory. A GPO can be linked to one or more Active Directory containers, such as a site, domain, or organizational unit.
Windows Server Active Directory Domain Service (ADDS) is a directory service that stores information about all objects in the domain and makes this data available to network users and administrators. Active Directory Domain Service provides secure, structured, hierarchical data storage for objects and the admin can easily manage all objects. The Active Directory Domain Controller is a server that runs Active Directory Domain Service and domain controllers to give the network user access to permitted resources anywhere on the network through a single logon process.
In this tutorial, we are going to Prohibit access to the Control Panel for a particular Active Directory organization unit.
Demo environment
- Computer Name: server1.test.com
- Operating System: Windows Server 2022 Datacenter
- IP Address: 192.168.0.2
- Domain: test.com
- Current domain controller (DC): server1.test.com
- DNS Server IP address: 192.168.0.2
- Organizational unit: TEST_OU
- A user within Organizational unit (TEST_OU): test\user1
Related tutorial
- Install and configure ADDS on Windows Server 2022
Steps for Configuring Group Policy
- Configuring Central Store GPO
- Create and configure Starter GPOs
- Create a GPO and Link
- Check the result on a client machine
Configuring Central Store Group Policy Object
The group policy central store is a central location to store all the group policy template files. This eliminates the need for admins to load and open group policy template files on systems used to manage group policy.
1. Open the Server Manager dashboard, click tools, and select Group Policy Management.
2. Right click on Default Domain Policy and select Edit.
3. On the Group Policy Management Editor, double click User Configuration, expand Policies, and then click Administrative Templates, if you check on that, you will see a note saying Administrative Templates: Policy definitions (ADMX files) retrieved from the local computer.
4. Access your Policies folder and create a new folder name PolicyDefinitions.
c:\windows\SYSVOL\sysvol\comsys.local
5. Access to your C:\windows\PolicyDefinitions folder, what you need to do here is to copy all .adml & .admx files.
6. Then, paste the .adml & .admx files that you copied just now into c:\windows\SYSVOL\sysvol\comsys.local\PolicyDefinitions folder.
7. Open the Group Policy Management Editor interface, expand User Configuration> Polices, point your cursor to the Administrative Templates folder, and verify that it reads: Administrative Templates: Policy definitions (ADMX files) retrieved from the central store.
Create and configure Starter GPOs
Starter GPOs are templates for Group Policy settings. It enables an administrator to create and have a pre-configured group of settings that represent a baseline for any future policy to be created.
8. Open the Server Manager dashboard, click tools, and select Group Policy Management.
9. Create a new Starter GPO, right-click the Starter GPOs folder, and then click New.
10. Enter Name and Comment for New Starter GPO and click OK.
- Name: New Starter GPO
- Comment: New Starter GPO
In this tutorial, we use Prohibit access to the Control Panel and PC settings policy for testing.
11. Right-click on New Starter GPO and Click Edit
12. Open Group Policy Management Editor interface.
Expand User Configuration> Administrative Templates> Control Panel and open Prohibit access to Control Panel and PC settings.
13. In Prohibit access to Control Panel and PC settings window, select Enable and click OK.
Create a GPO and Link
14. Open Group Policy Management, Right-click on OU and select Create a GPO in this domain and Link it here.
15. Enter Name, select Source Starter GPO, and click OK.
Check the result on a client machine
Client Demo environment
- Computer Name: server2.test.com
- Operating System: Windows Server 2022 Datacenter
- IP Address: 192.168.0.4
- Domain: test.com
- Organizational unit: TEST_OU
- A user within Organizational unit (TEST_OU): test\user1
16. Enter User Name and Password.
17. On the client, the machine waits for the policy to get updated automatically or manually updates the policy settings by running the command gpupdate /force in the command prompt.
18. Once you successfully log on, try to open Control Panel.
19. A restriction warning box will appear, This operation has been cancelled due to restrictions in effect on this computer. Please contact your system administrator.
Group Policy Management Console: An Introduction
The Group Policy Management Console (GPMC) is a one-stop solution for performing all the Group Policy functions an administrator has to deal with. This MMC snap-in provides all the information about Group Policies and allows one to view all the settings within a Group Policy Object (GPO). Many of the functions of the GPMC can also be scripted. The GPMC provides viewing, configuring, and analyzing GPO settings to know how they will affect target computers and users.
Here is a partial list of what administrators can do with the GPMC:
- Creating, modifying, deleting, reporting GPOs and controlling their application
- Performing Group Policy searches across the forest and domain(s)
- Check/control status of GPOs
- Linking and unlinking GPOs
- Performing backup, restore and import of GPOs
- Executing GPO modeling sessions to understand the effects of GPOs
- Setting and delegating permissions
The following are some of the highlights of the GPMC which make it such a handy tool:
- Easy user interface with drag-and-drop functionality
- Capability to backup, restore, import and copy GPOs
- Includes programmable interfaces
- Execution of fully scriptable functions
- Manages WMI filtering that helps in selectively applying GPOs
How to install Group Policy Management Console tools
You can install the GPMC using the Server manager. Here’s how you can do it in Windows Server 2016:
- Open the Server Manager Dashboard. You can do this by pressing Windows + R keys to open the Run tool, and then typing servermanager and pressing the Enter button.
- In the Dashboard section, click on Add Roles and Features.
- In the installation wizard window that pops up, under Installation Type select Role-based or feature-based installation. Then, click Next.
- Under Server Selection, select the Select a server from the server pool option. Then, click Next.
- Click Next under Server Roles.
- Under Features, select Group Policy Management. Click Next.If prompted to install any supporting roles, accept the default selection.
- Under Confirmation, click Install.
Once the installation process is complete, you can open the GPMC through Server manager under the Tools section.
Opening the GPMC
Alternatively, you can also use one of the following methods to open the GPMC:
- Go to Start → Run. Type gpmc.msc and click OK.
- Go to Start → Type gpmc.msc in the search bar and hit ENTER.
- Go to Start –> Administrative Tools –> Group Policy Management.
Before diving into working with GPOs using the GPMC, let’s take a look at what a GPO is.
What is a GPO?
A Group Policy in Active Directory is stored in the form of Group Policy Objects (GPOs). GPOs can be created like any other active directory object and are linked to a Site, domain, or OU in which the policy settings have to be applied. Hence, GPOs are how you can manage group policies and configure them as necessary. To learn more about GPOs and GPO management, you can read this article.
Creating an unlinked GPO
- Within the GPMC, right-click Group Policy Objects in the domain where the GPO is to be created and select New. Give it a suitable name.
- Click OK.
Editing a GPO
- In the GPMC, open the Group Policy Objects node.
- Right-click the appropriate GPO, and click Edit.
Deleting a GPO
- In the GPMC, open the Group Policy Objects node.
- Right-click the appropriate GPO, and click Delete.
- Click OK to confirm.
Note that it is best practice not to edit/delete the Default Domain Controllers Policy or the Default Domain Policy.
Let’s take a look at some of the other tasks that can be executed from the console.
Linking a GPO
- In the GPMC, locate the domain or OU to which the GPO is to be linked and right-click.
- To link an existing GPO, select the option Link an Existing GPO. In the Select GPO dialog box that appears, select the GPO that is to be linked and click OK.
- To link a new GPO, select the option Create a GPO in this domain, and link it here. Give a suitable name and click OK.
Disabling a GPO link
- In the GPMC, locate the GPO link which is to be disabled.
- Right click the GPO link and click Link Enabled. A check mark indicates that the link is enabled and the absence of it indicates that the link is disabled.
Managing GPO Backups
- In the GPMC, expand the Group Policy Objects node that contains the GPO that has to be backed up. Right-click the GPO, and then click Back Up.
- To back up all GPOs in the domain, right-click the Group Policy Objects node, and then click Back Up All.
- In the Back Up Group Policy Object dialog box, specify the path to the folder where the backed-up versions of the GPOs will reside. Click Back Up.
- Finally, click OK.
Restoring a GPO
- In the GPMC, expand the Group Policy Objects container. Right-click the GPO and then click Manage Backups.
- In the Manage Backups dialog box that appears, specify the path to locate the backup folder.
- From the list Backed up GPOs, select the GPO that needs to be restored, and click Restore.
- Confirm by clicking OK.
- Finally, click OK and then Close.
Importing settings from a GPO
- In the GPMC, expand the Group Policy Objects node. Right-click the GPO and then click Import Settings. The Import Settings Wizard opens.
- Click Next to continue.
- Backup the existing settings in the GPO by clicking Backup. Then click Next.
- Specify the path to the backup folder from which the settings are to be imported. Click Next.
- Select the GPO from which the settings are to be imported. Click Next.
- The wizard will automatically scan the settings in the backup to check for references needed. After the scan completes, click Next.
- Under Migrating References, select the method for transferring references. Click Next.
- Finally, click Finish to close the wizard.
Group Policy Modeling
Group Policy Modeling can simulate the policy implementation environment and can help administrators get a sense of how the GPOs affect different users and computers, thus helping them to plan before actually applying the policies.
The following steps illustrate how to work with the Group Policy Modeling Wizard:
- In the left pane of the GPMC, click on the forest to expand it.
- Right click the Group Policy Modeling container and click on the Group Policy Modeling Wizard option.
- In the Group Policy Modeling Wizard that is launched, click Next.
- Specify the domain where the GPO is to be analyzed and click Next.
- Specify the user and computer against which the policy settings are to be simulated. Click Next.
- In the page that follows, select a particular site if required, else skip to the final page and click Next.
- In the page that follows, specify an alternate network location if required, else skip to the final page and click Next. An alternate location can help administrators see the effects of the GPOs if the computer were to be moved to a different container in the AD.
- In the page that follows, use the Add/Remove options to simulate changes to all the security groups that the selected user is a member of if required, else skip to the final page and click Next.
- In the page that follows, include the WMI filters in the simulation if required, else skip to the final page and click Next.
- In the page that follows, a summary of all selections made in the wizard is displayed. To process the simulation click Next.
- Finally, click Finish to close the wizard.
This action creates a folder that can be seen in the left pane of the GPMC that bears the name of the user/computer that is tested. Open it to display the outcome of the simulation. These reports give information about the properties and policy settings of GPOs and how the implementation of group policy modeling proceeded/succeeded. The Summary tab gives information about the GPOs that were used to compile the policy. The Settings tab lists the effective policy settings. The Query tab displays the criteria based on which the simulation was carried out.
People also read
Managing GPOs in Active Directory
Group Policy Management Console (GPMC) – Part II
GPO Delegation
Introduction to Group Policy Management
Group Policy is a feature of Microsoft Windows operating systems that helps administrators manage and secure users and computers in Active Directory environments. Group Policy settings are grouped into Group Policy objects (GPOs) and applied to computer and user objects within the scope of the GPO.
For example, Group Policy objects can be used to manage:
- Configurations, such as desktop settings, startup scripts and logon/logoff scripts
- Security, including Active Directory (AD) password policies, account lockout policies and firewall settings
- Access to network resources like shared folders, printers and applications
- Software deployment, including installation of software on selected machines and scheduling of patches and updates.
This guide explains the key elements of Group Policy management.
Group Policy Management Tool
To manage GPOs, administrators use the Group Policy Management Console (GPMC). You can access this domain Group Policy editor from the Tools menu of Windows Server Manager.
You can see all the GPOs in a domain by clicking the Group Policy Objects container in the left pane of the Group Policy Management Console. Below, you can see that the AD domain ad.contoso.com has just one GPO, Default Domain Policy:
The Group Policy Management Console includes a Group Policy Editor, as shown here:
Types of Group Policy Settings
The left panel of the screenshot below shows the types of settings in a GPO:
As you can see, there are two primary categories: Computer Configuration and User Configuration.
Each of these has Policies and Preferences, which you can expand to configure:
- Software Settings
- Windows Settings
- Administrative Templates
Policies vs Preferences
Policies and Preferences can both be used to manage settings for Active Directory computer and user objects. The primary difference is as follows:
- Policies cannot be changed by users. Accordingly, settings related to security and regulatory compliance should be made in policies. Examples include password policies, account lockout policies, firewall policies and software restriction policies.
- Preferences can be changed by users, so they should be used only for user experience and environment settings. For example, you might provide a standard set of mapped network drives, printers or desktop shortcuts, but establishing them via Preferences will allow users to adjust them to meet their own needs.
Installing the Group Policy Management Console on Windows Server
To install the Group Policy Management Console on Windows Server, take these steps:
- Launch Server Manager by clicking on the Start menu and selecting Server Manager.
- In Server Manager, click Manage from the top menu, and then select Add Roles and Features.
- Choose Role-based or feature-based installation and click Next.
- Select the server where you want to install GPMC and click Next.
- On the “Select Server Roles” page click Next, since we are not adding a role.
- Scroll down, find “Group Policy Management,” and check the box next to it.
- Click “Next” any confirmation message once the installation is complete. Click “Close” to exit the wizard.
Installing the Group Policy Management Console on Windows
If you are using Windows 10 version 1809 or later, you can install GPMC using the Settings app:
- Open Settings by pressing WIN+I.
- Search for optional features.
- Click + Add a feature.
- Click RSAT: Group Policy Management Tools and then click Install.
If you are using an older version of Windows, you’ll need to download the correct version of RSAT from Microsoft’s website.
How to Create a GPO
To create a new Group Policy object:
- Open Server Manager, click Tools in the top-right corner and select Group Policy Management from the dropdown menu.
- In the Group Policy Management Console, expand the forest and domain where you want to link the GPO.
- Right-click on the OU, domain or site where you want to link the GPO and select the corresponding Create option, such as Create a GPO in this domain, and Link it here…
- Enter a descriptive name for the new GPO and click OK.
How to Edit a GPO
To edit Group Policy in the Group Policy Management Console, take the following steps:
- Expand the forest and domain to which the GPO belongs.
- Navigate to the OU, domain or site where the GPO is linked.
- Right-click on the GPO you want to edit and select Edit.
- In the Group Policy Management Editor, double-click the desired policy setting and modify it according to your requirements.
Computer settings are applied when Windows starts, and user settings are used when a user logs in. Group Policy background processing applies settings periodically if a GPO has been changed.
How to Link a GPO
To take effect, a GPO must be linked to at least one Active Directory container, such as an OU, domain or site. To link a GPO, take the following steps:
- In the Group Policy Management Console, expand the forest and domain where you want to link the GPO.
- Right-click the OU, domain or site where you want to link the GPO and select Link an Existing GPO.
- Choose the GPO you want to link from the list of available GPOs and click OK.
How to Enable or Disable a GPO Link
When a GPO link is disabled, its settings won’t apply to the objects in the linked container. Here’s how to enable or disable a GPO link:
- In the Group Policy Management Console, expand the Active Directory forest and domain to which the linked GPO belongs.
- Expand the container where the GPO is linked and right-click on the GPO.
- In the context menu, check Link Enabled to enable the link or uncheck it to disable the link.
How to Import GPO Settings
You can configure a GPO by importing settings from a backup GPO or template file. Here’s how it’s done:
- In the Group Policy Management Console, navigate to the OU, domain or site with the GPO to which you want to import settings.
- Right-click on the destination GPO and select Import Settings…
- Choose the backup or template file (.admx or .adml) containing the desired GPO settings and click Open.
- Since backup locations can contain multiple GPOs, select the one from which you want to import settings.
- Click Next twice, review the summary, and click Finish to complete the import process.
GPO Inheritance and Precedence
Group Policy inheritance and precedence determine how Group Policy objects are applied to objects.
Inheritance
Group Policy inheritance follows the hierarchical structure of AD domains and OUs. Domain-level policies apply to all objects (users, computers, groups) in the domain. OU-level policies apply to objects within a specific OU. Policies applied at a higher level in the hierarchy are inherited by child objects, so domain-level GPOs are inherited by all OUs in the domain, and a policy linked to an OU is inherited by all sub-OUs nested under that OU.
However, you can use the Block Inheritance setting on a site, domain or OU to stop GPOs linked to parent objects from being applied to child objects. Setting the Enforced flag on individual GPOs overrides the Block Inheritance setting.
To view the GPOs that an object inherits from parent objects, click on the object in GPMC and go to the Group Policy Inheritance tab.
Precedence
A given domain, site or OU can have multiple GPOs linked to it, and those policies could have conflicting settings. Group Policy precedence controls the order in which GPOs are applied and therefore which setting takes effect. The later a GPO is applied in the sequence, the higher its precedence.
The order in which policies are applied is as follows:
- Local Group Policy
- Site-level GPOs
- Domain-level GPOs
- OU-level GPOs
To view the GPOs linked to an object, click on the object in GPMC and go to the Linked Group Policy Objects tab. GPOs with a higher Link Order number take priority over those with a lower number. You can change the link order number by clicking on a GPO and using the arrows on the left to move it up or down.
Group Policy Extensibility
You can extend the functionality of Group Policy by integrating additional features, custom settings or third-party components. Here are several aspects of Group Policy extensibility:
- Administrative templates (.admx files) — Administrators can create custom templates to manage additional settings or configure custom policies.
- Custom Group Policy Preferences — You can create custom Preference items using XML files or scripts. These let you manage things like mapped drives, printers, registry settings, files and shortcuts on client computers.
- Group Policy client-side extensions (CSEs) — You can create custom CSEs to add extra settings, policies or management tasks.
- Group Policy filters and WMI filters — You can create filters to target Group Policy settings based on specific criteria, such as user or computer attributes.
- Third-party Group Policy tools — Third-party solutions provide additional management capabilities, reporting features, auditing tools and policy templates.
Backing Up GPOs
Create regular backups of your GPOs to ensure you have a recent copy in case of accidental or malicious deletion, corruption or misconfiguration. You should also back up GPOs after making significant changes or before performing maintenance tasks that could affect Group Policy settings.
Establish a centralized location for storing GPO backups to ensure easy access and management. Consider organizing backup files by domain, date or purpose to facilitate retrieval and recovery. Use descriptive naming conventions or metadata to identify backup versions and associated changes. Implement version control practices to track changes to GPOs over time, and maintain a history of backups.
Modeling Changes to Group Policy Settings
Group Policy Modeling is a GPMC feature that allows administrators to simulate how Group Policy settings would act for users and computers in an Active Directory environment. It provides a way to predict the outcome of applying specific Group Policy settings without implementing them.
Advanced Group Policy Management
Advanced Group Policy Management (AGPM) is a Microsoft Desktop Optimization Pack (MDOP) component that enhances the management, delegation, version control and auditing of Group Policy objects.
Unlike GPMC, AGPM is a client/server application. The server component stores GPOs and their histories offline. GPOs managed by AGPM are called controlled GPOs. Administrators can check them in and out, similar to how files or code are handled in GitHub or a document management system.
AGPM offers more control over GPOs than GPMC. Besides version control, you can assign roles like Reviewer, Editor and Approver to Group Policy administrators. This facilitates strict change control throughout the entire GPO lifecycle. AGPM auditing also provides deeper insight into changes in Group Policy.
How Netwrix Can Help
Netwrix Auditor extends traditional Group Policy management with enhanced visibility, auditing, change control and reporting functionalities that improve security, and compliance. For example, administrators get detailed insight into what was changed, who changed it and when the action occurred. From an intuitive interface, they can easily compare different versions of GPOs, identify specific changes and even roll back unwanted modifications.
This increased transparency empowers administrators to ensure that Group Policy settings align with organizational policies, security standards and regulatory requirements. By integrating Netwrix Auditor into their Group Policy management strategy, organizations can achieve a more secure, compliant and efficiently managed IT infrastructure.
Frequently Asked Questions
What is Active Directory Group Policy management?
Group Policy is a feature of Active Directory that enables administrators to control the configuration settings of users and computers. Group Policy management is the process of creating and maintaining Group Policy settings that enforce security, deploy software, manage desktop configurations and more.
How do you open the Group Policy Management Console?
To open the Active Directory Group Policy Management Console:
- Press Windows Key + R on your keyboard.
- In the Run dialog box that appears, type gpmc. msc and either press Enter or click OK.
How can I install the Group Policy Management Console?
To install GPMC on a Windows Server, take these steps:
- Launch Server Manager. You can usually find it in the taskbar, or you can locate it in the Start menu.
- In Server Manager, click Manage at the top-right corner and then select Add Roles and Features.
- On the “Before you begin” screen, click Next.
- On the “Select installation type” screen, choose Role-based or feature-based installation and then click Next.
- Select the server where you want to install the GPMC feature and click Next.
- On the “Select features” screen, check the box next to Group Policy Management. Click Next.
- Review your selections and click Install.
- Wait for the installation process to complete. Once you see a confirmation message, close Server Manager.
Which users are automatically granted permissions to perform Group Policy management tasks?
The Group Policy Creator Owners group is automatically created when an Active Directory forest is created. Members of the group can create, edit and manage Group Policy objects at the domain level. This group is typically used when administrators want to delegate control over Group Policy without granting full administrative privileges. By default, only the domain administrator is a member of this group.
IT consultant and author specializing in management and security technologies. Russell has more than 15 years of experience in IT, he has written a book on Windows security, and he coauthored a text for Microsoft’s Official Academic Course (MOAC) series.
Download Windows Speedup Tool to fix errors and make PC run faster
As a system administrator at an organization, if you want to manage the Group Policy settings of every networked computer, the Active Directory Group Policy Management Console is the only thing you can rely on. Here is how you can add or remove Group Policy Management Console in Windows Server 2022 through Server Manager.
What is Group Policy Management Console?
The Group Policy Management Console is an interface for organizing or managing the Group Policy settings of all networked computers. Through the console, you can apply for or remove Group Policy settings or changes on all computers of your organization.
To add Group Policy Management Console in Windows Server 2022, follow these steps:
- Open the Server Manager and select Manage > Add Roles and Features.
- Choose Role-based or feature-based installation.
- Choose the server and click Next.
- Select File and Store Services and click on Next.
- Tick the Group Policy Management checkbox.
- Click the Install button.
To learn more about these steps, continue reading.
First, you need to open the Server Manager. You can open it from the Start Menu or by searching for it in the Taskbar search box.
Then, click on Manage and select the Add Roles and Features option. The wizard will then appear on your screen. In the Installation Type tab, choose the Role-based or feature-based installation option and click the Next button.
Then, choose the server from the server pool and click on Next. In the Server Roles tab, ensure that the File and Store Services option is selected.
In the next tab, Features, you need to tick the Group Policy Management checkbox and click the Next button.
Finally, confirm the installation and click the Install button.
For your information, it may take a few moments. Do not interrupt the installation.
How to remove Group Policy Management Console from Windows Server 2022
To remove the Group Policy Management Console from Windows Server 2022, follow these steps:
- Open the Server Manager.
- Select Manage > Remove Roles and Features.
- Go to the Features tab.
- Tick the Group Policy Management checkbox.
- Click the Remove button.
First, open the Server Manager and go to Manage > Remove Roles and Features. Then, go to the Features tab and select the Group Policy Management checkbox.
Finally, click the Remove button. Wait a few moments for it to finish. Once it’s done, you can close all the windows.
I hope this guide helped you.
Read: How to Backup and Restore Group Policy Objects in Windows 11
What is the meaning of GPO in Windows Server?
GPO or Group policy Object is a consolidated interface of various things such as Group Policy settings, SOM (Scope of Management), security permissions, etc. If an organization uses Active Directory, it implies that the Group Policy settings are already integrated into GPO.
Read: Install Group Policy Management Console in Windows 11.
When he is not writing about Microsoft Windows or Office, Sudip likes to work with Photoshop. He has managed the front end and back end of many websites over the years. He is currently pursuing his Bachelor’s degree.
Reader Interactions
Групповые политики Active Directory позволяют централизованно применять одинаковые настройки ко множеству компьютеров и/или пользователей домена и существенно упрощают управление конфигурацией в доменной среде. Консоль Group Policy Management Console (GPMC.msc) – это основной инструмент для управления групповыми политиками (Group Policy Object, GPO) в Active Directory.
Содержание:
- Установка консоли GPMC в Windows
- Управление групповыми политиками Active Directory с помощью консоли Group Policy Management
Установка консоли GPMC в Windows
В Windows 10 и 11 консоль GPMC входит в состав RSAT, и вы можете установить ее через панель Settings. Перейдите Settings -> Apps -> Optional Features -> Add an optional feature -> выберите в списке RSAT: Group Policy Management Tools и нажмите Install.
Также вы можете установить консоль управления групповыми политиками в Windows 10 и 11 с помощью PowerShell:
Add-WindowsCapability -Online -Name Rsat.GroupPolicy.Management.Tools~~~~0.0.1.0
Или с помощью DISM:
DISM.exe /Online /add-capability /CapabilityName:Rsat.GroupPolicy.Management.Tools~~~~0.0.1.0
Обратите внимание, что в современных версиях Windows 10 и 11 для установки инструментов управления RSAT, ваш компьютер должен быть подключен к Интернету. Подробнее про установку инструментов администрирования (RSAT) в Windows описано в статье по ссылке.
В Windows Server 2022/2019/2016/2012R2 вы можете установить консоль управления GPO через Server Manager: Add Roles and Features -> Features -> Group Policy Management.
Также можно установить консоль GPMC в Windows Server с помощью PowerShell командлета Install-WindowsFeature:
Install-WindowsFeature GPMC
После установки, проверьте что ярлык Group Policy Management появится в разделе Administrative Tools в панели управления (Control Panel\System and Security\Administrative Tools). Ярлык ссылается на MMC оснастку
%SystemRoot%\system32\gpmc.msc
.
Управление групповыми политиками Active Directory с помощью консоли Group Policy Management
Консоль GPMC позволяет управлять групповыми политиками на уровне сайтов AD, доменов и организационными подразделениями (Organizational Unit).
Для запуска консоли выполните команду:
gpmc.msc
По умолчанию консоль подключается к контроллеру домена с FSMO ролью Primary Domain Controller Emulator (PDC). Вы можете подключиться к любому другому DC. Для этого щелкните правой кнопкой по имени домена и выберите Change Domain Controller (для комфортной работы рекомендуем подключиться к вашему Logon Server-у).
Разверните Forest -> Domain -> Ваш домен.
На этом скриншоте выделены:
- Имя домена, к которому подключена консоль;
- Групповые политики, которые назначены на различные OU (отображается вся структура OU, которую вы видите в консоли ADUC);
- Полный список политик (GPO) в текущем домене доступен в разделе Group Policy Objects.
Групповые политики Active Directory можно назначить на OU, сайт или весь домен. Чаще всего политики привязываются к OU с компьютерами или пользователями.
Чтобы создать новую GPO и сразу назначить ее на OU, щелкните по нужному контейнеру правой кнопкой и выберите Create a GPO in this domain, and Link it here.
Задайте имя GPO:
В консоли GPMC вы увидите вашу новую GPO, которая сразу назначена на выбранный вами контейнер (OU).
GPO активна (
Link Enabled = True
), это значит что ее настройки будут применяться ко всем объектом в данном OU.
Чтобы изменить настройки GPO выберите Edit.
Для управления параметрами групповой политики на компьютере Windows используется консоль локального редактора GPO – gpedit.msc. Он позволяет настроить параметры Windows с помощью одной или множественных локальных политик (MLGPO).
Перед вами откроется консоль редактора GPO, аналогичная локальному редактору GPO. Все настройки GPO разделены на две секции:
- Computer Configuration — здесь можно настроить параметров компьютера (Windows);
- User Сonfiguration – параметры, которые нужно применить для пользователей AD.
В каждой секции есть три подраздела:
- Software Settings – используется для установки и обновления программ через GPO;
- Windows Settings — здесь расположены основные параметры безопасности Windows: настройки политики паролей, блокировки аккаунтов, политики аудита, назначения прав пользователей и т.д;
- Administrative Templates – содержит параметры различных компонентов Windows. Здесь доступны как стандартные административные шаблоны Windows, так и дополнительно admx шаблоны, установленные администратором (например, admx шаблоны для управления программами Microsoft Office или шаблоны для Google Chrome). Рекомендуем использовать центральное хранилище административных шаблонов GPO для удобства управления.
Также здесь есть отдельный раздел Preferences. Здесь содержится дополнительный набор настроек Group Policy Preferences (GPP), которые вы можете задать для клиентских устройств через GPO.
Закройте редактор политики и вернитесь в консоль GPMC. Все настройки, которые вы изменили в GPO будут применены на клиентах при следующем цикле обновления настроек групповых политик.
Выберите вашу GPO, чтобы вывести ее основные параметры. Здесь доступны 4 вкладки:
- Scope – здесь видно на какие OU назначена эта политики. В разделе Security Filtering можно настроить группы безопасности, для членов которых должна применяться политики (по умолчанию здесь задано Authenticated Users, это значит, что политика применяется ко всем объектам в OU). В параметре WMI filtering можно задать дополнительные правила фильтрации объектов для которых должна применяться GPO (см. WMI фильтры GPO);
- Details – содержится базовая информация о GPO (владелец, когда создана и изменена, версия, GUID);
- Settings – содержится отчет о всех настроенных параметрах GPO (отчет похож на результаты команды gpresult);
- Delegation – выводит текущие разрешения GPO, позволяет изменить их.
Active Directory хранит GPO хранятся в виде набора файлов и папок в каталоге SYSVOL, который реплицируется между DC. Вы можете найти каталог определенной GPO по ее GUID (на вкладке Details). Используйте следующий UNC путь:
\\winitpro.ru\sysvol\winitpro.ru\Policies\{GUID}
Если вы хотите, чтобы политика перестала действовать на клиенты в данном OU, можно либо удалить ссылку (
Delete
, при этом сама объект GPO не будет удален), либо временно отключить ее действие (
Link Enabled = False
).
Обратите внимание, что в домене уже есть две политики, которые действуют на все компьютеры и контроллеры домена соответственно:
- Default Domain Policy
- Default Domain Controller Policy
В большинстве случае не рекомендуется использовать эти GPO для настройки параметров клиентов. Лучше создать новые политики и назначить их на уровень всего домена или контейнера Domain Controllers.
Также консоль Group Policy Management позволяет:
- Импортировать/экспортировать, создавать резервные копии и восстанавливать GPO
- Создавать результирующие отчеты политик — Resultant Set of Policy (RSoP)
- Удаленно обновлять настройки GPO на компьютерах
- Подготавливать GPO к миграции между доменами
В отдельной статье “Почему не применяется групповая политика к компьютеру?” рассмотрены такие основные элементы групповых политик Active Directory как:
- Наследование в групповых полотках
- Область действия и порядок применения GPO (LSDOU)
- Приоритете и управление порядком применения политик
- Замыкание групповых политик (Loopback Processing mode)
- Фильтрация GPO
- Форсирование применения GPO
Рекомендуем внимательно ознакомиться с этой статьей для более эффективного использования возможностей групповых политик и понимания принципов их работы.