1
00:00:00,040 --> 00:00:03,720
Welcome to the M365 FM podcast,
where we explore the people,
2
00:00:03,720 --> 00:00:06,559
ideas and technologies shaping
the future of work.
3
00:00:06,559 --> 00:00:09,839
What group policy actually does
somewhere in your company?
4
00:00:09,839 --> 00:00:12,320
Right now, a rule is telling a
computer what to do.
5
00:00:12,320 --> 00:00:13,400
You felt it in the password.
6
00:00:13,400 --> 00:00:14,679
That has to be long, the drive
7
00:00:14,679 --> 00:00:15,960
that appears on its own and the
8
00:00:15,960 --> 00:00:17,000
settings you're not allowed to
9
00:00:17,000 --> 00:00:17,480
touch.
10
00:00:17,480 --> 00:00:19,960
That system is called group
policy, and it reaches almost
11
00:00:19,960 --> 00:00:22,920
every windows machine in an
organization from one place.
12
00:00:22,920 --> 00:00:27,480
Welcome to the M365 FM podcast,
where we explore the people,
13
00:00:27,480 --> 00:00:30,239
ideas, and technologies shaping
the future of work.
14
00:00:30,239 --> 00:00:32,759
Today, we're breaking down group
policy in plain language.
15
00:00:32,759 --> 00:00:35,280
So by the end, you'll see how it
picks a winner when rules
16
00:00:35,280 --> 00:00:37,280
collide, where it breaks, and
how it fits.
17
00:00:37,280 --> 00:00:38,399
With Microsoft three hundred
18
00:00:38,399 --> 00:00:40,000
sixty five and Azure Group
19
00:00:40,000 --> 00:00:41,380
policy is the way a company sets
20
00:00:41,380 --> 00:00:42,679
one rule and lets windows apply
21
00:00:42,679 --> 00:00:43,359
it everywhere.
22
00:00:43,359 --> 00:00:46,119
The rule itself lives inside
something called a group policy
23
00:00:46,119 --> 00:00:48,119
object or a GPO for short.
24
00:00:48,119 --> 00:00:49,399
A GPO is basically a folder of
25
00:00:49,399 --> 00:00:50,600
instructions, and Group policy
26
00:00:50,600 --> 00:00:51,679
is the system that handles those
27
00:00:51,679 --> 00:00:52,399
instructions out.
28
00:00:52,399 --> 00:00:54,640
Without group policy, someone
would walk desk to desk,
29
00:00:54,640 --> 00:00:57,280
changing settings on every
machine by hand with it.
30
00:00:57,280 --> 00:01:00,159
An admin makes the change once
and every computer that should
31
00:01:00,159 --> 00:01:01,439
get it picks it up on its own.
32
00:01:01,439 --> 00:01:04,109
That's the difference between
managing ten computers and
33
00:01:04,109 --> 00:01:05,269
managing ten thousand.
34
00:01:05,269 --> 00:01:07,390
The rules themselves are
practical and familiar.
35
00:01:07,390 --> 00:01:08,950
It can force a minimum password
36
00:01:08,950 --> 00:01:10,629
length, decide how many failed
37
00:01:10,629 --> 00:01:12,269
attempts, lock an account, set
38
00:01:12,269 --> 00:01:13,569
the desktop background and lock
39
00:01:13,569 --> 00:01:13,989
screen.
40
00:01:13,989 --> 00:01:15,510
Map a shared network drive.
41
00:01:15,510 --> 00:01:18,430
Install a printer, control how
Windows Update behaves, and
42
00:01:18,430 --> 00:01:20,150
block new software installs.
43
00:01:20,150 --> 00:01:21,629
Most of the lockdown settings on
44
00:01:21,629 --> 00:01:22,909
a work laptop come from group
45
00:01:22,909 --> 00:01:23,510
policy.
46
00:01:23,510 --> 00:01:26,750
To understand where those rules
live, you need one more idea,
47
00:01:26,750 --> 00:01:27,629
and that's the domain.
48
00:01:27,629 --> 00:01:30,310
A domain is a large group of
computers and user accounts that
49
00:01:30,310 --> 00:01:32,109
all trust one central authority.
50
00:01:32,109 --> 00:01:35,430
That authority runs on servers
called domain controllers.
51
00:01:35,430 --> 00:01:36,790
And group policy is part of the
52
00:01:36,790 --> 00:01:38,230
system that manages the domain,
53
00:01:38,230 --> 00:01:39,109
which is called Active
54
00:01:39,109 --> 00:01:40,390
Directory.
55
00:01:40,390 --> 00:01:42,790
The rules are stored in two
places that work together.
56
00:01:42,790 --> 00:01:45,829
The settings sit in Active
Directory itself, and the files
57
00:01:45,829 --> 00:01:49,230
that describe the changes sit in
a shared folder called Sysvol,
58
00:01:49,230 --> 00:01:52,510
which copies to every domain
controller that copying matters
59
00:01:52,510 --> 00:01:55,790
because it means any computer in
the domain can reach the rules
60
00:01:55,790 --> 00:01:58,829
from a nearby server instead of
one single machine.
61
00:01:58,829 --> 00:02:00,150
So group policy is a central
62
00:02:00,150 --> 00:02:01,549
rule sheet, and every windows
63
00:02:01,549 --> 00:02:03,105
machine in the domain reads from
64
00:02:03,105 --> 00:02:04,939
it automatically, while the same
65
00:02:04,939 --> 00:02:05,900
setting can come from three
66
00:02:05,900 --> 00:02:06,620
places.
67
00:02:06,620 --> 00:02:07,980
A GPO doesn't apply everywhere.
68
00:02:07,980 --> 00:02:09,300
Just because you made it, you
69
00:02:09,300 --> 00:02:10,500
have to link it to a place and
70
00:02:10,500 --> 00:02:12,120
there are three places it can go
71
00:02:12,120 --> 00:02:13,620
a site, a domain, or an
72
00:02:13,620 --> 00:02:14,780
organizational unit.
73
00:02:14,780 --> 00:02:16,219
A site is about physical
location.
74
00:02:16,219 --> 00:02:18,620
A domain is the whole
organization and an
75
00:02:18,620 --> 00:02:22,259
organizational unit or OU is
best thought of as a folder for
76
00:02:22,259 --> 00:02:23,699
users or computers.
77
00:02:23,699 --> 00:02:26,460
Everything inside that folder
inherits the rule and folders
78
00:02:26,460 --> 00:02:29,819
inside folders inherit it to a
rule linked high up reaches
79
00:02:29,819 --> 00:02:33,060
everything below it without you
repeating the work, which is the
80
00:02:33,060 --> 00:02:36,219
power of inheritance and also
where the confusion starts.
81
00:02:36,219 --> 00:02:37,379
Admins describe the order with a
82
00:02:37,379 --> 00:02:39,120
short label l, s, d o u. It
83
00:02:39,120 --> 00:02:40,460
stands for local, then site,
84
00:02:40,460 --> 00:02:42,419
then domain, then ou and windows
85
00:02:42,419 --> 00:02:43,500
reads them in exactly that
86
00:02:43,500 --> 00:02:44,020
order.
87
00:02:44,020 --> 00:02:46,180
The rule that matters most is
simple.
88
00:02:46,180 --> 00:02:49,259
The last one processed wins and
the OU closest to the person or
89
00:02:49,259 --> 00:02:51,979
computer is processed last, so
it usually wins.
90
00:02:51,979 --> 00:02:53,139
When people say the closest
91
00:02:53,139 --> 00:02:54,580
setting wins, this is what they
92
00:02:54,580 --> 00:02:55,099
mean.
93
00:02:55,099 --> 00:02:57,259
The order matters in real life
for a simple reason.
94
00:02:57,259 --> 00:02:58,539
An admin sets a rule at the top
95
00:02:58,539 --> 00:02:59,620
of the tree and assumes it
96
00:02:59,620 --> 00:03:00,259
covers everything.
97
00:03:00,259 --> 00:03:03,060
Then someone links a different
rule two folders deeper and
98
00:03:03,060 --> 00:03:04,680
quietly overrides it.
99
00:03:04,680 --> 00:03:06,719
Nothing is broken because that's
the design.
100
00:03:06,719 --> 00:03:07,759
But if you don't know the order,
101
00:03:07,759 --> 00:03:08,879
you'll spend an afternoon
102
00:03:08,879 --> 00:03:10,240
chasing a setting that isn't the
103
00:03:10,240 --> 00:03:11,000
one winning.
104
00:03:11,000 --> 00:03:12,759
A concrete example makes this
clearer.
105
00:03:12,759 --> 00:03:15,240
Say the domain blocks USB drives
for security.
106
00:03:15,240 --> 00:03:16,039
The IT teams.
107
00:03:16,039 --> 00:03:17,639
OU has a rule that allows them.
108
00:03:17,639 --> 00:03:20,599
Because technicians need USB
drives to do their jobs.
109
00:03:20,599 --> 00:03:23,520
It keeps their drives and
everyone else stays blocked
110
00:03:23,520 --> 00:03:25,280
because the closer rule wins.
111
00:03:25,280 --> 00:03:27,199
There are two escape hatches
worth knowing.
112
00:03:27,199 --> 00:03:28,520
Block inheritance lets a folder
113
00:03:28,520 --> 00:03:29,960
refuse rules coming from above
114
00:03:29,960 --> 00:03:30,240
it.
115
00:03:30,240 --> 00:03:32,960
Enforced is the opposite kind of
power because a rule marked
116
00:03:32,960 --> 00:03:36,560
enforced applies anyway, even to
a folder that tried to block it.
117
00:03:36,560 --> 00:03:38,120
Blocking gives you a clean slate
118
00:03:38,120 --> 00:03:39,360
and enforcing punches straight
119
00:03:39,360 --> 00:03:40,520
through it.
120
00:03:40,520 --> 00:03:42,599
How windows decides which rule
wins.
121
00:03:42,599 --> 00:03:43,960
Inside a single folder, you can
122
00:03:43,960 --> 00:03:45,520
link more than one GPO and they
123
00:03:45,520 --> 00:03:46,759
don't apply in the order you'd
124
00:03:46,759 --> 00:03:48,159
guess they process from the
125
00:03:48,159 --> 00:03:49,439
bottom of the list to the top,
126
00:03:49,439 --> 00:03:50,919
which means the GPO listed first
127
00:03:50,919 --> 00:03:52,360
is applied last, and the last
128
00:03:52,360 --> 00:03:53,759
one to apply is the one that
129
00:03:53,759 --> 00:03:54,360
wins.
130
00:03:54,360 --> 00:03:56,039
The two ideas fit together
neatly.
131
00:03:56,039 --> 00:03:58,800
Closest wins across the
hierarchy and last applied wins
132
00:03:58,800 --> 00:04:00,120
within one folder.
133
00:04:00,120 --> 00:04:03,000
When two rules sit at the exact
same level, the list order
134
00:04:03,000 --> 00:04:05,750
decides and an admin can drag
the arrows to change it.
135
00:04:05,750 --> 00:04:07,030
Then there's the question of who
136
00:04:07,030 --> 00:04:08,430
receives a rule, and group
137
00:04:08,430 --> 00:04:09,750
policy answers that with two
138
00:04:09,750 --> 00:04:11,310
filters, security filtering
139
00:04:11,310 --> 00:04:12,750
decides the people, computers or
140
00:04:12,750 --> 00:04:13,150
groups.
141
00:04:13,150 --> 00:04:15,150
A GPO applies to WMI.
142
00:04:15,150 --> 00:04:16,069
Filtering decides the
143
00:04:16,069 --> 00:04:17,149
conditions, like whether the
144
00:04:17,149 --> 00:04:18,389
machine runs a certain version
145
00:04:18,389 --> 00:04:19,310
of windows.
146
00:04:19,310 --> 00:04:22,310
In plain terms, one filter
answers who, and the other
147
00:04:22,310 --> 00:04:23,790
answers on what kind of machine.
148
00:04:23,790 --> 00:04:24,970
If the machine doesn't meet the
149
00:04:24,970 --> 00:04:26,750
WMI condition, windows skips the
150
00:04:26,750 --> 00:04:28,709
entire GPO, not just part of it
151
00:04:28,709 --> 00:04:29,910
that trips people up because a
152
00:04:29,910 --> 00:04:30,910
policy can look perfectly
153
00:04:30,910 --> 00:04:32,110
correct and still do nothing on
154
00:04:32,110 --> 00:04:33,069
a machine that failed the
155
00:04:33,069 --> 00:04:33,509
filter.
156
00:04:33,509 --> 00:04:35,870
A quick example shows how the
two stack together.
157
00:04:35,870 --> 00:04:38,629
An admin links a GPO to the
whole sales department, then
158
00:04:38,629 --> 00:04:40,870
narrows it with security
filtering so it lands only on
159
00:04:40,870 --> 00:04:42,149
the managers laptops.
160
00:04:42,149 --> 00:04:45,709
The same GPO could also carry a
WMI filter, so it skips any
161
00:04:45,709 --> 00:04:48,470
machine that isn't running the
newest version of windows two.
162
00:04:48,470 --> 00:04:51,310
Small conditions turn one policy
into something precise.
163
00:04:51,310 --> 00:04:52,629
One more distinction explains a
164
00:04:52,629 --> 00:04:54,029
lot of everyday behavior, and
165
00:04:54,029 --> 00:04:55,269
that's policies versus
166
00:04:55,269 --> 00:04:56,430
preferences.
167
00:04:56,430 --> 00:04:59,089
A policy is enforced, which
means the user can't change it
168
00:04:59,089 --> 00:05:00,149
while it's active.
169
00:05:00,149 --> 00:05:01,269
A preference sets a starting
170
00:05:01,269 --> 00:05:02,470
value that the user can then
171
00:05:02,470 --> 00:05:04,029
change and it reapplies on the
172
00:05:04,029 --> 00:05:04,629
next refresh.
173
00:05:04,629 --> 00:05:06,105
If they do, preferences also
174
00:05:06,105 --> 00:05:07,500
support their own targeting, so
175
00:05:07,500 --> 00:05:09,180
a single GPO can map one drive
176
00:05:09,180 --> 00:05:10,300
for finance and a different
177
00:05:10,300 --> 00:05:11,899
drive for sales without building
178
00:05:11,899 --> 00:05:12,779
separate folders.
179
00:05:12,779 --> 00:05:14,980
That's why two people on the
same team can see completely
180
00:05:14,980 --> 00:05:18,300
different drives at Logan while
sharing the exact same policy.
181
00:05:18,300 --> 00:05:19,740
When your changes actually show
182
00:05:19,740 --> 00:05:21,180
up, this explains the most
183
00:05:21,180 --> 00:05:22,379
common frustration.
184
00:05:22,379 --> 00:05:23,420
The one where you change a
185
00:05:23,420 --> 00:05:24,639
setting and nothing seems to
186
00:05:24,639 --> 00:05:25,259
happen.
187
00:05:25,259 --> 00:05:26,660
Computer settings apply when the
188
00:05:26,660 --> 00:05:28,100
machine starts up, and user
189
00:05:28,100 --> 00:05:29,420
settings apply when someone logs
190
00:05:29,420 --> 00:05:29,939
on.
191
00:05:29,939 --> 00:05:31,899
That first moment is when a rule
takes hold.
192
00:05:31,899 --> 00:05:34,339
So a brand new setting often
waits for the next restart or
193
00:05:34,339 --> 00:05:35,420
sign in after that.
194
00:05:35,420 --> 00:05:36,980
Windows refreshes policy in the
195
00:05:36,980 --> 00:05:38,500
background every ninety minutes,
196
00:05:38,500 --> 00:05:40,060
and it adds a random delay of up
197
00:05:40,060 --> 00:05:41,579
to thirty minutes on top in
198
00:05:41,579 --> 00:05:42,300
practice.
199
00:05:42,300 --> 00:05:43,899
A change lands somewhere between
200
00:05:43,899 --> 00:05:45,139
ninety and one hundred and
201
00:05:45,139 --> 00:05:46,259
twenty minutes.
202
00:05:46,259 --> 00:05:47,620
Domain controllers the servers
203
00:05:47,620 --> 00:05:49,019
holding the rules refresh every
204
00:05:49,019 --> 00:05:50,259
five minutes with no random
205
00:05:50,259 --> 00:05:50,860
delay.
206
00:05:50,860 --> 00:05:52,579
That random delay isn't
laziness.
207
00:05:52,579 --> 00:05:53,180
It's there.
208
00:05:53,180 --> 00:05:56,620
So thousands of computers don't
all call home at the same second
209
00:05:56,620 --> 00:05:59,420
and overwhelm the server, and
spreading the load keeps the
210
00:05:59,420 --> 00:06:00,779
whole thing stable.
211
00:06:00,779 --> 00:06:03,379
During a refresh, the computer
compares version numbers.
212
00:06:03,379 --> 00:06:05,620
If a GPO hasn't changed since
the last check.
213
00:06:05,620 --> 00:06:08,449
Most settings don't reapply,
which is good for performance.
214
00:06:08,449 --> 00:06:11,569
Edit the GPO and the version
number goes up, which forces
215
00:06:11,569 --> 00:06:14,649
every affected machine to
reprocess it on the next cycle.
216
00:06:14,649 --> 00:06:16,250
Security settings are the
exception.
217
00:06:16,250 --> 00:06:18,769
They reapply every sixteen hours
whether or not anything changed.
218
00:06:18,769 --> 00:06:19,889
So if someone tampers with a
219
00:06:19,889 --> 00:06:21,129
firewall rule or a password
220
00:06:21,129 --> 00:06:22,930
policy, it gets put back within
221
00:06:22,930 --> 00:06:23,569
that window.
222
00:06:23,569 --> 00:06:25,009
That's a deliberate safety net.
223
00:06:25,009 --> 00:06:26,490
One more quirk explains why a
224
00:06:26,490 --> 00:06:27,709
change sometimes needs two
225
00:06:27,709 --> 00:06:28,370
tries.
226
00:06:28,370 --> 00:06:29,529
Modern windows applies those
227
00:06:29,529 --> 00:06:30,490
rules while you're already
228
00:06:30,490 --> 00:06:31,490
working, so you get to your
229
00:06:31,490 --> 00:06:33,529
desktop faster, which means some
230
00:06:33,529 --> 00:06:35,129
settings need a restart and then
231
00:06:35,129 --> 00:06:36,410
a fresh logon before they fully
232
00:06:36,410 --> 00:06:37,050
appear.
233
00:06:37,050 --> 00:06:39,850
It isn't broken, it's just
waiting its turn.
234
00:06:39,850 --> 00:06:42,529
A laptop complicates the timing
a little, and the reason is
235
00:06:42,529 --> 00:06:43,449
worth a moment.
236
00:06:43,449 --> 00:06:45,129
Working from home on a VPN still
237
00:06:45,129 --> 00:06:46,970
lets policy refresh just more
238
00:06:46,970 --> 00:06:48,050
slowly than it would in the
239
00:06:48,050 --> 00:06:48,689
office.
240
00:06:48,689 --> 00:06:51,810
Working fully offline stops it
altogether, and the machine runs
241
00:06:51,810 --> 00:06:54,290
on the last set of rules it
managed to pull down.
242
00:06:54,290 --> 00:06:56,370
If you ever need to skip the
wait, there are three tools
243
00:06:56,370 --> 00:06:57,769
you'll hear about the command.
244
00:06:57,769 --> 00:06:59,930
GP update forces a refresh right
now.
245
00:06:59,930 --> 00:07:01,410
GP result shows what applied,
246
00:07:01,410 --> 00:07:02,810
and the Group policy results
247
00:07:02,810 --> 00:07:04,470
report in the management console
248
00:07:04,470 --> 00:07:05,889
gives you the same picture in a
249
00:07:05,889 --> 00:07:07,610
clickable view.
250
00:07:07,610 --> 00:07:09,560
What this looks like in a real
company.
251
00:07:09,560 --> 00:07:12,160
Picture one small company, about
two hundred people, so you can
252
00:07:12,160 --> 00:07:13,480
see how the pieces add up.
253
00:07:13,480 --> 00:07:15,800
The first thing they'd set is
the password and lockout policy.
254
00:07:15,800 --> 00:07:17,079
At the domain level, that means
255
00:07:17,079 --> 00:07:18,600
a minimum length, a rule about
256
00:07:18,600 --> 00:07:20,360
complexity, and a limit on how
257
00:07:20,360 --> 00:07:21,759
many wrong tries before an
258
00:07:21,759 --> 00:07:22,680
account locks.
259
00:07:22,680 --> 00:07:24,720
Everyone gets it because it's
linked at the top.
260
00:07:24,720 --> 00:07:26,480
Next comes the desktop itself.
261
00:07:26,480 --> 00:07:29,600
They hide settings they don't
want touched pin the apps people
262
00:07:29,600 --> 00:07:32,480
use and choose the desktop
picture and lock screen so every
263
00:07:32,480 --> 00:07:34,160
machine looks consistent.
264
00:07:34,160 --> 00:07:35,759
A new hire signs in and the
265
00:07:35,759 --> 00:07:36,920
computer already feels like the
266
00:07:36,920 --> 00:07:38,319
company's computer instead of a
267
00:07:38,319 --> 00:07:39,199
blank one.
268
00:07:39,199 --> 00:07:41,519
Then come the everyday
conveniences people notice only
269
00:07:41,519 --> 00:07:42,399
when they're missing.
270
00:07:42,399 --> 00:07:44,240
Someone in finance signs in, and
271
00:07:44,240 --> 00:07:45,540
their shared drive and the floor
272
00:07:45,540 --> 00:07:46,800
printer appear automatically
273
00:07:46,800 --> 00:07:47,920
because those are mapped for
274
00:07:47,920 --> 00:07:48,519
their group.
275
00:07:48,519 --> 00:07:49,480
That's group policy.
276
00:07:49,480 --> 00:07:51,240
Doing quiet work in the
background.
277
00:07:51,240 --> 00:07:52,680
Software is next.
278
00:07:52,680 --> 00:07:55,920
A company can push an approved
app to one department control
279
00:07:55,920 --> 00:07:58,959
when Windows Update installs,
and stop people from installing
280
00:07:58,959 --> 00:08:00,439
whatever they find online.
281
00:08:00,439 --> 00:08:03,160
This is where group policy stops
being about cosmetics and starts
282
00:08:03,160 --> 00:08:04,839
being about control and cost.
283
00:08:04,839 --> 00:08:07,199
The browser and the small
details get covered too.
284
00:08:07,199 --> 00:08:08,879
A home page, a list of trusted
sites.
285
00:08:08,879 --> 00:08:11,339
A shortcut on the desktop to the
company portal.
286
00:08:11,339 --> 00:08:13,379
None of it is dramatic on its
own, but together, it's the
287
00:08:13,379 --> 00:08:15,220
difference between a managed
fleet and a mess.
288
00:08:15,220 --> 00:08:17,300
One detail surprises people.
289
00:08:17,300 --> 00:08:18,180
Some of these settings are
290
00:08:18,180 --> 00:08:18,939
policies and some are
291
00:08:18,939 --> 00:08:19,699
preferences.
292
00:08:19,699 --> 00:08:21,660
So some are locked and some can
be changed.
293
00:08:21,660 --> 00:08:23,180
Folder redirection, which moves
294
00:08:23,180 --> 00:08:24,500
the users documents to a server
295
00:08:24,500 --> 00:08:25,699
so they follow the person from
296
00:08:25,699 --> 00:08:27,259
machine to machine, is its own
297
00:08:27,259 --> 00:08:28,660
special case that only runs at
298
00:08:28,660 --> 00:08:29,339
logon.
299
00:08:29,339 --> 00:08:32,179
A company can enforce a rule on
one thing and simply suggest a
300
00:08:32,179 --> 00:08:35,620
setting on another, and both are
group policy behind the scenes.
301
00:08:35,620 --> 00:08:39,019
Making one of these rules is
less dramatic than it sounds.
302
00:08:39,019 --> 00:08:40,379
An admin opens the Group policy
303
00:08:40,379 --> 00:08:41,659
Management console, creates a
304
00:08:41,659 --> 00:08:43,419
GPO, picks the settings, links
305
00:08:43,419 --> 00:08:44,740
it to the right folder, and
306
00:08:44,740 --> 00:08:45,679
waits for the machines to
307
00:08:45,679 --> 00:08:46,460
refresh.
308
00:08:46,460 --> 00:08:47,659
The hard part isn't creating it
309
00:08:47,659 --> 00:08:48,940
because the hard part is naming
310
00:08:48,940 --> 00:08:50,419
it clearly and remembering why
311
00:08:50,419 --> 00:08:51,059
it exists.
312
00:08:51,059 --> 00:08:54,460
Six months later, that same
power has a flip side, and the
313
00:08:54,460 --> 00:08:57,980
mistakes that cause the most
pain are predictable.
314
00:08:57,980 --> 00:08:59,539
The mistakes that trip people
up.
315
00:08:59,539 --> 00:09:02,539
Group policy is powerful enough
to cause real damage, and almost
316
00:09:02,539 --> 00:09:04,899
all of that damage comes from a
short list of habits.
317
00:09:04,899 --> 00:09:06,059
Sprawl is the most common.
318
00:09:06,059 --> 00:09:07,659
A company keeps adding Gpos one
319
00:09:07,659 --> 00:09:08,840
for every request until there
320
00:09:08,840 --> 00:09:10,019
are hundreds of overlapping
321
00:09:10,019 --> 00:09:11,169
rules, and nobody can predict
322
00:09:11,169 --> 00:09:12,250
what a given machine ends up
323
00:09:12,250 --> 00:09:12,730
with.
324
00:09:12,730 --> 00:09:15,529
Fewer policies with clear names
and a written purpose beat a
325
00:09:15,529 --> 00:09:16,809
giant pile every time.
326
00:09:16,809 --> 00:09:18,889
Speed is the next trap or the
lack of it.
327
00:09:18,889 --> 00:09:21,450
Too many policies, and
especially heavy logon scripts
328
00:09:21,450 --> 00:09:24,250
drag out startup and sign in
until people complain that their
329
00:09:24,250 --> 00:09:25,649
computer takes forever.
330
00:09:25,649 --> 00:09:28,210
Slow sign ins are one of the
most common complaints in
331
00:09:28,210 --> 00:09:31,250
windows environments, and
they're almost always fixable by
332
00:09:31,250 --> 00:09:32,769
trimming and consolidating.
333
00:09:32,769 --> 00:09:35,210
Then there's a loophole people
forget if a user is a local
334
00:09:35,210 --> 00:09:38,330
administrator and the GPO itself
hasn't changed, they can undo a
335
00:09:38,330 --> 00:09:41,169
setting, and windows won't put
it back until the gpos version
336
00:09:41,169 --> 00:09:44,250
changes, or the sixteen hour
security cycle runs.
337
00:09:44,250 --> 00:09:45,690
A local admin can win a fight.
338
00:09:45,690 --> 00:09:47,169
The policy thinks it already
won.
339
00:09:47,169 --> 00:09:48,850
One mistake has a real history
behind it.
340
00:09:48,850 --> 00:09:51,250
Admins used to push local
passwords through group policy
341
00:09:51,250 --> 00:09:54,210
preferences, and those passwords
were encrypted with a key that
342
00:09:54,210 --> 00:09:56,610
Microsoft accidentally
published, which meant anyone
343
00:09:56,610 --> 00:09:57,490
could read them.
344
00:09:57,490 --> 00:10:00,409
Microsoft removed that ability
back in May twenty fourteen with
345
00:10:00,409 --> 00:10:03,529
a fix called miss fourteen and
zero two five, but old stored
346
00:10:03,529 --> 00:10:06,529
values still turn up in systems
that were never cleaned up.
347
00:10:06,529 --> 00:10:09,610
The lesson is bigger than the
bug because a policy is never a
348
00:10:09,610 --> 00:10:10,970
safe place for a secret.
349
00:10:10,970 --> 00:10:12,240
Blocking inheritance is another
350
00:10:12,240 --> 00:10:13,840
one and it bites later, and
351
00:10:13,840 --> 00:10:15,120
admin blocks a folder to get a
352
00:10:15,120 --> 00:10:16,279
clean slate and accidentally
353
00:10:16,279 --> 00:10:17,399
cuts off a rule the business
354
00:10:17,399 --> 00:10:17,600
needs.
355
00:10:17,600 --> 00:10:18,960
Like a security baseline.
356
00:10:18,960 --> 00:10:21,159
Blocking is a sharp tool, and it
should come with a note about
357
00:10:21,159 --> 00:10:23,919
why testing is the step people
skip when they're busy.
358
00:10:23,919 --> 00:10:25,320
Apply a rule to everyone at
once.
359
00:10:25,320 --> 00:10:28,080
With no pilot group, and a
broken policy hits the whole
360
00:10:28,080 --> 00:10:29,720
company in a single morning.
361
00:10:29,720 --> 00:10:32,720
The safe habit is to test on a
small group, watch it for a day,
362
00:10:32,720 --> 00:10:34,320
and only then widen it out.
363
00:10:34,320 --> 00:10:35,519
And then there's documentation,
364
00:10:35,519 --> 00:10:36,840
which sounds boring until it
365
00:10:36,840 --> 00:10:37,440
isn't.
366
00:10:37,440 --> 00:10:38,620
The settings nobody remembers
367
00:10:38,620 --> 00:10:39,620
adding are the ones that cause
368
00:10:39,620 --> 00:10:39,960
trouble.
369
00:10:39,960 --> 00:10:42,840
Two years later, when the person
who set them has moved on.
370
00:10:42,840 --> 00:10:45,960
A short note on each GPO saves
hours of guessing.
371
00:10:45,960 --> 00:10:48,480
There's a trap in the other
direction, too, where a company
372
00:10:48,480 --> 00:10:51,840
tries to fix sprawl by cramming
everything into one giant GPO.
373
00:10:51,840 --> 00:10:54,200
That's worse, because now a
single mistake takes down every
374
00:10:54,200 --> 00:10:55,320
setting at once.
375
00:10:55,320 --> 00:10:56,919
AIM for small, focused policies
376
00:10:56,919 --> 00:10:58,440
grouped by purpose, so a change
377
00:10:58,440 --> 00:10:59,600
to one doesn't ripple through
378
00:10:59,600 --> 00:11:00,320
the rest.
379
00:11:00,320 --> 00:11:02,200
Where group policy stops working
380
00:11:02,200 --> 00:11:03,759
after all that, it's worth being
381
00:11:03,759 --> 00:11:05,000
honest about the edges, because
382
00:11:05,000 --> 00:11:06,039
knowing them is what makes you
383
00:11:06,039 --> 00:11:07,039
look like you know what you're
384
00:11:07,039 --> 00:11:07,679
doing.
385
00:11:07,679 --> 00:11:09,519
Group policy is client side.
386
00:11:09,519 --> 00:11:10,720
The computer pulls the rules
387
00:11:10,720 --> 00:11:12,000
down and the server doesn't push
388
00:11:12,000 --> 00:11:12,639
them out.
389
00:11:12,639 --> 00:11:14,669
A machine needs a working
connection to a domain
390
00:11:14,669 --> 00:11:16,230
controller to get fresh policy.
391
00:11:16,230 --> 00:11:17,429
So a laptop that's off the
392
00:11:17,429 --> 00:11:19,110
network for a long stretch keeps
393
00:11:19,110 --> 00:11:20,509
applying the last rules it knew
394
00:11:20,509 --> 00:11:20,990
about.
395
00:11:20,990 --> 00:11:22,990
It's also built for windows on a
domain.
396
00:11:22,990 --> 00:11:25,269
Macs, phones and tablets sit
397
00:11:25,269 --> 00:11:26,769
outside its reach, and so do
398
00:11:26,769 --> 00:11:27,909
machines that were never joined
399
00:11:27,909 --> 00:11:28,870
to the domain in the first
400
00:11:28,870 --> 00:11:29,389
place.
401
00:11:29,389 --> 00:11:31,190
The big one is the cloud devices
402
00:11:31,190 --> 00:11:32,330
that are joined only to
403
00:11:32,330 --> 00:11:33,950
Microsoft Entra ID, the cloud
404
00:11:33,950 --> 00:11:35,309
identity service once called
405
00:11:35,309 --> 00:11:36,350
Azure AD.
406
00:11:36,350 --> 00:11:38,029
Don't process group policy at
all.
407
00:11:38,029 --> 00:11:40,309
There's no domain controller in
that picture, so there's nothing
408
00:11:40,309 --> 00:11:41,909
for a GPO to attach to.
409
00:11:41,909 --> 00:11:43,629
It's not a monitoring tool
either.
410
00:11:43,629 --> 00:11:46,830
Group policy enforces settings,
and it doesn't tell you what
411
00:11:46,830 --> 00:11:49,710
people are doing or whether
anyone is misusing their access.
412
00:11:49,710 --> 00:11:52,750
People sometimes expect it to be
a security camera, and it isn't.
413
00:11:52,750 --> 00:11:54,029
There's also the timing limit we
414
00:11:54,029 --> 00:11:55,269
already covered between the
415
00:11:55,269 --> 00:11:57,070
refresh window and the two cycle
416
00:11:57,070 --> 00:11:57,549
quirk.
417
00:11:57,549 --> 00:11:58,950
Group policy is reliable, but it
418
00:11:58,950 --> 00:12:00,269
isn't instant, and treating it
419
00:12:00,269 --> 00:12:01,990
as instant is how you end up
420
00:12:01,990 --> 00:12:03,070
convinced it's broken when it
421
00:12:03,070 --> 00:12:03,590
isn't.
422
00:12:03,590 --> 00:12:04,909
None of that means it's going
away.
423
00:12:04,909 --> 00:12:07,429
Microsoft still treats group
policy as a core part of
424
00:12:07,429 --> 00:12:10,350
managing windows, and huge
numbers of organizations rely on
425
00:12:10,350 --> 00:12:11,230
it every day.
426
00:12:11,230 --> 00:12:12,870
The honest position is that it's
mature.
427
00:12:12,870 --> 00:12:14,700
It has firm edges and a newer
428
00:12:14,700 --> 00:12:15,980
tool now covers the ground it
429
00:12:15,980 --> 00:12:16,740
can't reach.
430
00:12:16,740 --> 00:12:18,419
Hybrid setups blur the line, and
431
00:12:18,419 --> 00:12:19,460
this is where a lot of beginners
432
00:12:19,460 --> 00:12:20,259
get stuck.
433
00:12:20,259 --> 00:12:21,399
A machine can be joined to a
434
00:12:21,399 --> 00:12:22,860
domain and enrolled in Intune at
435
00:12:22,860 --> 00:12:24,220
the same time, which means it
436
00:12:24,220 --> 00:12:25,419
can receive rules from both
437
00:12:25,419 --> 00:12:25,940
sides.
438
00:12:25,940 --> 00:12:28,600
That overlap is real, and it's
worth knowing about, because
439
00:12:28,600 --> 00:12:31,340
figuring out which side is
actually in charge is a normal
440
00:12:31,340 --> 00:12:32,779
part of hybrid work.
441
00:12:32,779 --> 00:12:34,980
How group policy fits with
Microsoft three hundred sixty
442
00:12:34,980 --> 00:12:35,860
five and Azure.
443
00:12:35,860 --> 00:12:37,299
If cloud devices don't use group
444
00:12:37,299 --> 00:12:38,820
policy, the cloud world has its
445
00:12:38,820 --> 00:12:40,299
own answer, and that answer is
446
00:12:40,299 --> 00:12:41,539
Microsoft Intune.
447
00:12:41,539 --> 00:12:43,580
The way the two connect is worth
understanding.
448
00:12:43,580 --> 00:12:44,980
Start with the identity side.
449
00:12:44,980 --> 00:12:47,899
Microsoft Entra ID does not
process group policy.
450
00:12:47,899 --> 00:12:48,740
Full stop.
451
00:12:48,740 --> 00:12:51,379
Group policy needs Active
Directory Domain services, the
452
00:12:51,379 --> 00:12:54,179
on premises system that has been
running domains for decades.
453
00:12:54,179 --> 00:12:57,019
So a device joined only to enter
ID is managed through Intune
454
00:12:57,019 --> 00:12:59,899
instead using something called
the settings catalog.
455
00:12:59,899 --> 00:13:01,299
The goal is the same in both
worlds.
456
00:13:01,299 --> 00:13:02,860
You still decide a setting and
457
00:13:02,860 --> 00:13:04,100
you still want it to reach the
458
00:13:04,100 --> 00:13:05,059
right machines.
459
00:13:05,059 --> 00:13:07,899
What changes is the engine and
where the rules live.
460
00:13:07,899 --> 00:13:09,539
Group policy targets by folder.
461
00:13:09,539 --> 00:13:12,340
So a device's location in the
domain decides who gets what.
462
00:13:12,340 --> 00:13:14,580
Intune targets by assignment to
people and groups.
463
00:13:14,580 --> 00:13:16,960
So it works for devices no
matter where they are.
464
00:13:16,960 --> 00:13:18,440
The bridge between the two is a
465
00:13:18,440 --> 00:13:19,759
tool called Group Policy
466
00:13:19,759 --> 00:13:21,320
Analytics, and it's built right
467
00:13:21,320 --> 00:13:22,080
into Intune.
468
00:13:22,080 --> 00:13:23,639
You export your existing Gpos,
469
00:13:23,639 --> 00:13:25,000
import them, and Intune reports
470
00:13:25,000 --> 00:13:26,279
back which settings are
471
00:13:26,279 --> 00:13:27,799
supported in the cloud and which
472
00:13:27,799 --> 00:13:28,559
ones aren't.
473
00:13:28,559 --> 00:13:30,799
It turns a vague worry into a
clear list.
474
00:13:30,799 --> 00:13:33,720
Then the migrate feature takes
the supported settings and turns
475
00:13:33,720 --> 00:13:36,440
them into an Intune settings
catalog policy you can assign to
476
00:13:36,440 --> 00:13:37,799
your cloud devices.
477
00:13:37,799 --> 00:13:38,639
The settings that aren't
478
00:13:38,639 --> 00:13:39,919
supported have to be rebuilt
479
00:13:39,919 --> 00:13:41,000
another way or dropped on
480
00:13:41,000 --> 00:13:41,679
purpose.
481
00:13:41,679 --> 00:13:44,399
Either way, you know, instead of
guessing, there's one warning
482
00:13:44,399 --> 00:13:47,080
here because it's the mistake
this whole migration invites.
483
00:13:47,080 --> 00:13:49,960
Don't copy every GPO into Intune
one for one, since that just
484
00:13:49,960 --> 00:13:51,840
moves old clutter to a new home.
485
00:13:51,840 --> 00:13:55,080
The point of the analytics step
is to migrate only the settings
486
00:13:55,080 --> 00:13:56,480
that still earn their place.
487
00:13:56,480 --> 00:13:57,879
Group policy also still lives
488
00:13:57,879 --> 00:13:59,080
inside Azure in a couple of
489
00:13:59,080 --> 00:13:59,799
places.
490
00:13:59,799 --> 00:14:02,600
Microsoft Entra Domain Services,
a managed domain service in the
491
00:14:02,600 --> 00:14:05,159
cloud, does support group
policy, so you can use it for
492
00:14:05,159 --> 00:14:06,759
machines joined to that domain.
493
00:14:06,759 --> 00:14:09,840
Azure Virtual Desktop is the
other one where hosts join to a
494
00:14:09,840 --> 00:14:12,940
traditional domain still follow
group policy while cloud joined
495
00:14:12,940 --> 00:14:14,600
hosts follow Intune.
496
00:14:14,600 --> 00:14:17,470
In both cases, the rule is
simple because how the device is
497
00:14:17,470 --> 00:14:19,350
joined decides how it's managed.
498
00:14:19,350 --> 00:14:20,710
Microsoft's own message here is
499
00:14:20,710 --> 00:14:21,809
coexistence rather than a
500
00:14:21,809 --> 00:14:22,509
cutover.
501
00:14:22,509 --> 00:14:25,830
Group policy still runs a huge
share of enterprise windows, and
502
00:14:25,830 --> 00:14:29,110
Intune picks up the devices that
never touch a domain.
503
00:14:29,110 --> 00:14:31,950
Learning one teaches you most of
the other because the thinking
504
00:14:31,950 --> 00:14:32,830
is the same.
505
00:14:32,830 --> 00:14:33,750
The practical path most
506
00:14:33,750 --> 00:14:35,269
companies take is phased rather
507
00:14:35,269 --> 00:14:36,269
than sudden.
508
00:14:36,269 --> 00:14:38,509
They run group policy and Intune
side by side.
509
00:14:38,509 --> 00:14:41,269
Move one group of devices at a
time and keep the on premises
510
00:14:41,269 --> 00:14:43,389
rules alive for the machines
that still need them.
511
00:14:43,389 --> 00:14:44,509
Nothing has to happen all at
512
00:14:44,509 --> 00:14:45,669
once, which is good news if
513
00:14:45,669 --> 00:14:46,509
you're learning this for the
514
00:14:46,509 --> 00:14:48,110
first time.
515
00:14:48,110 --> 00:14:50,230
The short version and a question
for you.
516
00:14:50,230 --> 00:14:52,750
The whole thing comes down to
one simple picture.
517
00:14:52,750 --> 00:14:55,429
Group policy is a central rule
sheet for windows computers.
518
00:14:55,429 --> 00:14:57,909
And when rules collide, the one
closest to the person or
519
00:14:57,909 --> 00:14:59,429
computer usually wins.
520
00:14:59,429 --> 00:15:00,629
Changes arrive on a schedule
521
00:15:00,629 --> 00:15:02,070
rather than instantly, and
522
00:15:02,070 --> 00:15:03,309
devices that live only in the
523
00:15:03,309 --> 00:15:04,629
cloud are managed by Intune
524
00:15:04,629 --> 00:15:05,110
instead.
525
00:15:05,110 --> 00:15:06,350
So here's my question for you.
526
00:15:06,350 --> 00:15:09,590
Which setting on your own work
computer do you now suspect came
527
00:15:09,590 --> 00:15:10,509
from group policy?
528
00:15:10,509 --> 00:15:11,870
If this made the topic feel less
529
00:15:11,870 --> 00:15:14,330
intimidating, subscribe to M365
530
00:15:14,330 --> 00:15:16,029
FM to master the tools and the
531
00:15:16,029 --> 00:15:17,470
mindset shaping the future of
532
00:15:17,470 --> 00:15:18,149
work.
00:00:00,040 --> 00:00:03,720
Welcome to the M365 FM podcast,
where we explore the people,
2
00:00:03,720 --> 00:00:06,559
ideas and technologies shaping
the future of work.
3
00:00:06,559 --> 00:00:09,839
What group policy actually does
somewhere in your company?
4
00:00:09,839 --> 00:00:12,320
Right now, a rule is telling a
computer what to do.
5
00:00:12,320 --> 00:00:13,400
You felt it in the password.
6
00:00:13,400 --> 00:00:14,679
That has to be long, the drive
7
00:00:14,679 --> 00:00:15,960
that appears on its own and the
8
00:00:15,960 --> 00:00:17,000
settings you're not allowed to
9
00:00:17,000 --> 00:00:17,480
touch.
10
00:00:17,480 --> 00:00:19,960
That system is called group
policy, and it reaches almost
11
00:00:19,960 --> 00:00:22,920
every windows machine in an
organization from one place.
12
00:00:22,920 --> 00:00:27,480
Welcome to the M365 FM podcast,
where we explore the people,
13
00:00:27,480 --> 00:00:30,239
ideas, and technologies shaping
the future of work.
14
00:00:30,239 --> 00:00:32,759
Today, we're breaking down group
policy in plain language.
15
00:00:32,759 --> 00:00:35,280
So by the end, you'll see how it
picks a winner when rules
16
00:00:35,280 --> 00:00:37,280
collide, where it breaks, and
how it fits.
17
00:00:37,280 --> 00:00:38,399
With Microsoft three hundred
18
00:00:38,399 --> 00:00:40,000
sixty five and Azure Group
19
00:00:40,000 --> 00:00:41,380
policy is the way a company sets
20
00:00:41,380 --> 00:00:42,679
one rule and lets windows apply
21
00:00:42,679 --> 00:00:43,359
it everywhere.
22
00:00:43,359 --> 00:00:46,119
The rule itself lives inside
something called a group policy
23
00:00:46,119 --> 00:00:48,119
object or a GPO for short.
24
00:00:48,119 --> 00:00:49,399
A GPO is basically a folder of
25
00:00:49,399 --> 00:00:50,600
instructions, and Group policy
26
00:00:50,600 --> 00:00:51,679
is the system that handles those
27
00:00:51,679 --> 00:00:52,399
instructions out.
28
00:00:52,399 --> 00:00:54,640
Without group policy, someone
would walk desk to desk,
29
00:00:54,640 --> 00:00:57,280
changing settings on every
machine by hand with it.
30
00:00:57,280 --> 00:01:00,159
An admin makes the change once
and every computer that should
31
00:01:00,159 --> 00:01:01,439
get it picks it up on its own.
32
00:01:01,439 --> 00:01:04,109
That's the difference between
managing ten computers and
33
00:01:04,109 --> 00:01:05,269
managing ten thousand.
34
00:01:05,269 --> 00:01:07,390
The rules themselves are
practical and familiar.
35
00:01:07,390 --> 00:01:08,950
It can force a minimum password
36
00:01:08,950 --> 00:01:10,629
length, decide how many failed
37
00:01:10,629 --> 00:01:12,269
attempts, lock an account, set
38
00:01:12,269 --> 00:01:13,569
the desktop background and lock
39
00:01:13,569 --> 00:01:13,989
screen.
40
00:01:13,989 --> 00:01:15,510
Map a shared network drive.
41
00:01:15,510 --> 00:01:18,430
Install a printer, control how
Windows Update behaves, and
42
00:01:18,430 --> 00:01:20,150
block new software installs.
43
00:01:20,150 --> 00:01:21,629
Most of the lockdown settings on
44
00:01:21,629 --> 00:01:22,909
a work laptop come from group
45
00:01:22,909 --> 00:01:23,510
policy.
46
00:01:23,510 --> 00:01:26,750
To understand where those rules
live, you need one more idea,
47
00:01:26,750 --> 00:01:27,629
and that's the domain.
48
00:01:27,629 --> 00:01:30,310
A domain is a large group of
computers and user accounts that
49
00:01:30,310 --> 00:01:32,109
all trust one central authority.
50
00:01:32,109 --> 00:01:35,430
That authority runs on servers
called domain controllers.
51
00:01:35,430 --> 00:01:36,790
And group policy is part of the
52
00:01:36,790 --> 00:01:38,230
system that manages the domain,
53
00:01:38,230 --> 00:01:39,109
which is called Active
54
00:01:39,109 --> 00:01:40,390
Directory.
55
00:01:40,390 --> 00:01:42,790
The rules are stored in two
places that work together.
56
00:01:42,790 --> 00:01:45,829
The settings sit in Active
Directory itself, and the files
57
00:01:45,829 --> 00:01:49,230
that describe the changes sit in
a shared folder called Sysvol,
58
00:01:49,230 --> 00:01:52,510
which copies to every domain
controller that copying matters
59
00:01:52,510 --> 00:01:55,790
because it means any computer in
the domain can reach the rules
60
00:01:55,790 --> 00:01:58,829
from a nearby server instead of
one single machine.
61
00:01:58,829 --> 00:02:00,150
So group policy is a central
62
00:02:00,150 --> 00:02:01,549
rule sheet, and every windows
63
00:02:01,549 --> 00:02:03,105
machine in the domain reads from
64
00:02:03,105 --> 00:02:04,939
it automatically, while the same
65
00:02:04,939 --> 00:02:05,900
setting can come from three
66
00:02:05,900 --> 00:02:06,620
places.
67
00:02:06,620 --> 00:02:07,980
A GPO doesn't apply everywhere.
68
00:02:07,980 --> 00:02:09,300
Just because you made it, you
69
00:02:09,300 --> 00:02:10,500
have to link it to a place and
70
00:02:10,500 --> 00:02:12,120
there are three places it can go
71
00:02:12,120 --> 00:02:13,620
a site, a domain, or an
72
00:02:13,620 --> 00:02:14,780
organizational unit.
73
00:02:14,780 --> 00:02:16,219
A site is about physical
location.
74
00:02:16,219 --> 00:02:18,620
A domain is the whole
organization and an
75
00:02:18,620 --> 00:02:22,259
organizational unit or OU is
best thought of as a folder for
76
00:02:22,259 --> 00:02:23,699
users or computers.
77
00:02:23,699 --> 00:02:26,460
Everything inside that folder
inherits the rule and folders
78
00:02:26,460 --> 00:02:29,819
inside folders inherit it to a
rule linked high up reaches
79
00:02:29,819 --> 00:02:33,060
everything below it without you
repeating the work, which is the
80
00:02:33,060 --> 00:02:36,219
power of inheritance and also
where the confusion starts.
81
00:02:36,219 --> 00:02:37,379
Admins describe the order with a
82
00:02:37,379 --> 00:02:39,120
short label l, s, d o u. It
83
00:02:39,120 --> 00:02:40,460
stands for local, then site,
84
00:02:40,460 --> 00:02:42,419
then domain, then ou and windows
85
00:02:42,419 --> 00:02:43,500
reads them in exactly that
86
00:02:43,500 --> 00:02:44,020
order.
87
00:02:44,020 --> 00:02:46,180
The rule that matters most is
simple.
88
00:02:46,180 --> 00:02:49,259
The last one processed wins and
the OU closest to the person or
89
00:02:49,259 --> 00:02:51,979
computer is processed last, so
it usually wins.
90
00:02:51,979 --> 00:02:53,139
When people say the closest
91
00:02:53,139 --> 00:02:54,580
setting wins, this is what they
92
00:02:54,580 --> 00:02:55,099
mean.
93
00:02:55,099 --> 00:02:57,259
The order matters in real life
for a simple reason.
94
00:02:57,259 --> 00:02:58,539
An admin sets a rule at the top
95
00:02:58,539 --> 00:02:59,620
of the tree and assumes it
96
00:02:59,620 --> 00:03:00,259
covers everything.
97
00:03:00,259 --> 00:03:03,060
Then someone links a different
rule two folders deeper and
98
00:03:03,060 --> 00:03:04,680
quietly overrides it.
99
00:03:04,680 --> 00:03:06,719
Nothing is broken because that's
the design.
100
00:03:06,719 --> 00:03:07,759
But if you don't know the order,
101
00:03:07,759 --> 00:03:08,879
you'll spend an afternoon
102
00:03:08,879 --> 00:03:10,240
chasing a setting that isn't the
103
00:03:10,240 --> 00:03:11,000
one winning.
104
00:03:11,000 --> 00:03:12,759
A concrete example makes this
clearer.
105
00:03:12,759 --> 00:03:15,240
Say the domain blocks USB drives
for security.
106
00:03:15,240 --> 00:03:16,039
The IT teams.
107
00:03:16,039 --> 00:03:17,639
OU has a rule that allows them.
108
00:03:17,639 --> 00:03:20,599
Because technicians need USB
drives to do their jobs.
109
00:03:20,599 --> 00:03:23,520
It keeps their drives and
everyone else stays blocked
110
00:03:23,520 --> 00:03:25,280
because the closer rule wins.
111
00:03:25,280 --> 00:03:27,199
There are two escape hatches
worth knowing.
112
00:03:27,199 --> 00:03:28,520
Block inheritance lets a folder
113
00:03:28,520 --> 00:03:29,960
refuse rules coming from above
114
00:03:29,960 --> 00:03:30,240
it.
115
00:03:30,240 --> 00:03:32,960
Enforced is the opposite kind of
power because a rule marked
116
00:03:32,960 --> 00:03:36,560
enforced applies anyway, even to
a folder that tried to block it.
117
00:03:36,560 --> 00:03:38,120
Blocking gives you a clean slate
118
00:03:38,120 --> 00:03:39,360
and enforcing punches straight
119
00:03:39,360 --> 00:03:40,520
through it.
120
00:03:40,520 --> 00:03:42,599
How windows decides which rule
wins.
121
00:03:42,599 --> 00:03:43,960
Inside a single folder, you can
122
00:03:43,960 --> 00:03:45,520
link more than one GPO and they
123
00:03:45,520 --> 00:03:46,759
don't apply in the order you'd
124
00:03:46,759 --> 00:03:48,159
guess they process from the
125
00:03:48,159 --> 00:03:49,439
bottom of the list to the top,
126
00:03:49,439 --> 00:03:50,919
which means the GPO listed first
127
00:03:50,919 --> 00:03:52,360
is applied last, and the last
128
00:03:52,360 --> 00:03:53,759
one to apply is the one that
129
00:03:53,759 --> 00:03:54,360
wins.
130
00:03:54,360 --> 00:03:56,039
The two ideas fit together
neatly.
131
00:03:56,039 --> 00:03:58,800
Closest wins across the
hierarchy and last applied wins
132
00:03:58,800 --> 00:04:00,120
within one folder.
133
00:04:00,120 --> 00:04:03,000
When two rules sit at the exact
same level, the list order
134
00:04:03,000 --> 00:04:05,750
decides and an admin can drag
the arrows to change it.
135
00:04:05,750 --> 00:04:07,030
Then there's the question of who
136
00:04:07,030 --> 00:04:08,430
receives a rule, and group
137
00:04:08,430 --> 00:04:09,750
policy answers that with two
138
00:04:09,750 --> 00:04:11,310
filters, security filtering
139
00:04:11,310 --> 00:04:12,750
decides the people, computers or
140
00:04:12,750 --> 00:04:13,150
groups.
141
00:04:13,150 --> 00:04:15,150
A GPO applies to WMI.
142
00:04:15,150 --> 00:04:16,069
Filtering decides the
143
00:04:16,069 --> 00:04:17,149
conditions, like whether the
144
00:04:17,149 --> 00:04:18,389
machine runs a certain version
145
00:04:18,389 --> 00:04:19,310
of windows.
146
00:04:19,310 --> 00:04:22,310
In plain terms, one filter
answers who, and the other
147
00:04:22,310 --> 00:04:23,790
answers on what kind of machine.
148
00:04:23,790 --> 00:04:24,970
If the machine doesn't meet the
149
00:04:24,970 --> 00:04:26,750
WMI condition, windows skips the
150
00:04:26,750 --> 00:04:28,709
entire GPO, not just part of it
151
00:04:28,709 --> 00:04:29,910
that trips people up because a
152
00:04:29,910 --> 00:04:30,910
policy can look perfectly
153
00:04:30,910 --> 00:04:32,110
correct and still do nothing on
154
00:04:32,110 --> 00:04:33,069
a machine that failed the
155
00:04:33,069 --> 00:04:33,509
filter.
156
00:04:33,509 --> 00:04:35,870
A quick example shows how the
two stack together.
157
00:04:35,870 --> 00:04:38,629
An admin links a GPO to the
whole sales department, then
158
00:04:38,629 --> 00:04:40,870
narrows it with security
filtering so it lands only on
159
00:04:40,870 --> 00:04:42,149
the managers laptops.
160
00:04:42,149 --> 00:04:45,709
The same GPO could also carry a
WMI filter, so it skips any
161
00:04:45,709 --> 00:04:48,470
machine that isn't running the
newest version of windows two.
162
00:04:48,470 --> 00:04:51,310
Small conditions turn one policy
into something precise.
163
00:04:51,310 --> 00:04:52,629
One more distinction explains a
164
00:04:52,629 --> 00:04:54,029
lot of everyday behavior, and
165
00:04:54,029 --> 00:04:55,269
that's policies versus
166
00:04:55,269 --> 00:04:56,430
preferences.
167
00:04:56,430 --> 00:04:59,089
A policy is enforced, which
means the user can't change it
168
00:04:59,089 --> 00:05:00,149
while it's active.
169
00:05:00,149 --> 00:05:01,269
A preference sets a starting
170
00:05:01,269 --> 00:05:02,470
value that the user can then
171
00:05:02,470 --> 00:05:04,029
change and it reapplies on the
172
00:05:04,029 --> 00:05:04,629
next refresh.
173
00:05:04,629 --> 00:05:06,105
If they do, preferences also
174
00:05:06,105 --> 00:05:07,500
support their own targeting, so
175
00:05:07,500 --> 00:05:09,180
a single GPO can map one drive
176
00:05:09,180 --> 00:05:10,300
for finance and a different
177
00:05:10,300 --> 00:05:11,899
drive for sales without building
178
00:05:11,899 --> 00:05:12,779
separate folders.
179
00:05:12,779 --> 00:05:14,980
That's why two people on the
same team can see completely
180
00:05:14,980 --> 00:05:18,300
different drives at Logan while
sharing the exact same policy.
181
00:05:18,300 --> 00:05:19,740
When your changes actually show
182
00:05:19,740 --> 00:05:21,180
up, this explains the most
183
00:05:21,180 --> 00:05:22,379
common frustration.
184
00:05:22,379 --> 00:05:23,420
The one where you change a
185
00:05:23,420 --> 00:05:24,639
setting and nothing seems to
186
00:05:24,639 --> 00:05:25,259
happen.
187
00:05:25,259 --> 00:05:26,660
Computer settings apply when the
188
00:05:26,660 --> 00:05:28,100
machine starts up, and user
189
00:05:28,100 --> 00:05:29,420
settings apply when someone logs
190
00:05:29,420 --> 00:05:29,939
on.
191
00:05:29,939 --> 00:05:31,899
That first moment is when a rule
takes hold.
192
00:05:31,899 --> 00:05:34,339
So a brand new setting often
waits for the next restart or
193
00:05:34,339 --> 00:05:35,420
sign in after that.
194
00:05:35,420 --> 00:05:36,980
Windows refreshes policy in the
195
00:05:36,980 --> 00:05:38,500
background every ninety minutes,
196
00:05:38,500 --> 00:05:40,060
and it adds a random delay of up
197
00:05:40,060 --> 00:05:41,579
to thirty minutes on top in
198
00:05:41,579 --> 00:05:42,300
practice.
199
00:05:42,300 --> 00:05:43,899
A change lands somewhere between
200
00:05:43,899 --> 00:05:45,139
ninety and one hundred and
201
00:05:45,139 --> 00:05:46,259
twenty minutes.
202
00:05:46,259 --> 00:05:47,620
Domain controllers the servers
203
00:05:47,620 --> 00:05:49,019
holding the rules refresh every
204
00:05:49,019 --> 00:05:50,259
five minutes with no random
205
00:05:50,259 --> 00:05:50,860
delay.
206
00:05:50,860 --> 00:05:52,579
That random delay isn't
laziness.
207
00:05:52,579 --> 00:05:53,180
It's there.
208
00:05:53,180 --> 00:05:56,620
So thousands of computers don't
all call home at the same second
209
00:05:56,620 --> 00:05:59,420
and overwhelm the server, and
spreading the load keeps the
210
00:05:59,420 --> 00:06:00,779
whole thing stable.
211
00:06:00,779 --> 00:06:03,379
During a refresh, the computer
compares version numbers.
212
00:06:03,379 --> 00:06:05,620
If a GPO hasn't changed since
the last check.
213
00:06:05,620 --> 00:06:08,449
Most settings don't reapply,
which is good for performance.
214
00:06:08,449 --> 00:06:11,569
Edit the GPO and the version
number goes up, which forces
215
00:06:11,569 --> 00:06:14,649
every affected machine to
reprocess it on the next cycle.
216
00:06:14,649 --> 00:06:16,250
Security settings are the
exception.
217
00:06:16,250 --> 00:06:18,769
They reapply every sixteen hours
whether or not anything changed.
218
00:06:18,769 --> 00:06:19,889
So if someone tampers with a
219
00:06:19,889 --> 00:06:21,129
firewall rule or a password
220
00:06:21,129 --> 00:06:22,930
policy, it gets put back within
221
00:06:22,930 --> 00:06:23,569
that window.
222
00:06:23,569 --> 00:06:25,009
That's a deliberate safety net.
223
00:06:25,009 --> 00:06:26,490
One more quirk explains why a
224
00:06:26,490 --> 00:06:27,709
change sometimes needs two
225
00:06:27,709 --> 00:06:28,370
tries.
226
00:06:28,370 --> 00:06:29,529
Modern windows applies those
227
00:06:29,529 --> 00:06:30,490
rules while you're already
228
00:06:30,490 --> 00:06:31,490
working, so you get to your
229
00:06:31,490 --> 00:06:33,529
desktop faster, which means some
230
00:06:33,529 --> 00:06:35,129
settings need a restart and then
231
00:06:35,129 --> 00:06:36,410
a fresh logon before they fully
232
00:06:36,410 --> 00:06:37,050
appear.
233
00:06:37,050 --> 00:06:39,850
It isn't broken, it's just
waiting its turn.
234
00:06:39,850 --> 00:06:42,529
A laptop complicates the timing
a little, and the reason is
235
00:06:42,529 --> 00:06:43,449
worth a moment.
236
00:06:43,449 --> 00:06:45,129
Working from home on a VPN still
237
00:06:45,129 --> 00:06:46,970
lets policy refresh just more
238
00:06:46,970 --> 00:06:48,050
slowly than it would in the
239
00:06:48,050 --> 00:06:48,689
office.
240
00:06:48,689 --> 00:06:51,810
Working fully offline stops it
altogether, and the machine runs
241
00:06:51,810 --> 00:06:54,290
on the last set of rules it
managed to pull down.
242
00:06:54,290 --> 00:06:56,370
If you ever need to skip the
wait, there are three tools
243
00:06:56,370 --> 00:06:57,769
you'll hear about the command.
244
00:06:57,769 --> 00:06:59,930
GP update forces a refresh right
now.
245
00:06:59,930 --> 00:07:01,410
GP result shows what applied,
246
00:07:01,410 --> 00:07:02,810
and the Group policy results
247
00:07:02,810 --> 00:07:04,470
report in the management console
248
00:07:04,470 --> 00:07:05,889
gives you the same picture in a
249
00:07:05,889 --> 00:07:07,610
clickable view.
250
00:07:07,610 --> 00:07:09,560
What this looks like in a real
company.
251
00:07:09,560 --> 00:07:12,160
Picture one small company, about
two hundred people, so you can
252
00:07:12,160 --> 00:07:13,480
see how the pieces add up.
253
00:07:13,480 --> 00:07:15,800
The first thing they'd set is
the password and lockout policy.
254
00:07:15,800 --> 00:07:17,079
At the domain level, that means
255
00:07:17,079 --> 00:07:18,600
a minimum length, a rule about
256
00:07:18,600 --> 00:07:20,360
complexity, and a limit on how
257
00:07:20,360 --> 00:07:21,759
many wrong tries before an
258
00:07:21,759 --> 00:07:22,680
account locks.
259
00:07:22,680 --> 00:07:24,720
Everyone gets it because it's
linked at the top.
260
00:07:24,720 --> 00:07:26,480
Next comes the desktop itself.
261
00:07:26,480 --> 00:07:29,600
They hide settings they don't
want touched pin the apps people
262
00:07:29,600 --> 00:07:32,480
use and choose the desktop
picture and lock screen so every
263
00:07:32,480 --> 00:07:34,160
machine looks consistent.
264
00:07:34,160 --> 00:07:35,759
A new hire signs in and the
265
00:07:35,759 --> 00:07:36,920
computer already feels like the
266
00:07:36,920 --> 00:07:38,319
company's computer instead of a
267
00:07:38,319 --> 00:07:39,199
blank one.
268
00:07:39,199 --> 00:07:41,519
Then come the everyday
conveniences people notice only
269
00:07:41,519 --> 00:07:42,399
when they're missing.
270
00:07:42,399 --> 00:07:44,240
Someone in finance signs in, and
271
00:07:44,240 --> 00:07:45,540
their shared drive and the floor
272
00:07:45,540 --> 00:07:46,800
printer appear automatically
273
00:07:46,800 --> 00:07:47,920
because those are mapped for
274
00:07:47,920 --> 00:07:48,519
their group.
275
00:07:48,519 --> 00:07:49,480
That's group policy.
276
00:07:49,480 --> 00:07:51,240
Doing quiet work in the
background.
277
00:07:51,240 --> 00:07:52,680
Software is next.
278
00:07:52,680 --> 00:07:55,920
A company can push an approved
app to one department control
279
00:07:55,920 --> 00:07:58,959
when Windows Update installs,
and stop people from installing
280
00:07:58,959 --> 00:08:00,439
whatever they find online.
281
00:08:00,439 --> 00:08:03,160
This is where group policy stops
being about cosmetics and starts
282
00:08:03,160 --> 00:08:04,839
being about control and cost.
283
00:08:04,839 --> 00:08:07,199
The browser and the small
details get covered too.
284
00:08:07,199 --> 00:08:08,879
A home page, a list of trusted
sites.
285
00:08:08,879 --> 00:08:11,339
A shortcut on the desktop to the
company portal.
286
00:08:11,339 --> 00:08:13,379
None of it is dramatic on its
own, but together, it's the
287
00:08:13,379 --> 00:08:15,220
difference between a managed
fleet and a mess.
288
00:08:15,220 --> 00:08:17,300
One detail surprises people.
289
00:08:17,300 --> 00:08:18,180
Some of these settings are
290
00:08:18,180 --> 00:08:18,939
policies and some are
291
00:08:18,939 --> 00:08:19,699
preferences.
292
00:08:19,699 --> 00:08:21,660
So some are locked and some can
be changed.
293
00:08:21,660 --> 00:08:23,180
Folder redirection, which moves
294
00:08:23,180 --> 00:08:24,500
the users documents to a server
295
00:08:24,500 --> 00:08:25,699
so they follow the person from
296
00:08:25,699 --> 00:08:27,259
machine to machine, is its own
297
00:08:27,259 --> 00:08:28,660
special case that only runs at
298
00:08:28,660 --> 00:08:29,339
logon.
299
00:08:29,339 --> 00:08:32,179
A company can enforce a rule on
one thing and simply suggest a
300
00:08:32,179 --> 00:08:35,620
setting on another, and both are
group policy behind the scenes.
301
00:08:35,620 --> 00:08:39,019
Making one of these rules is
less dramatic than it sounds.
302
00:08:39,019 --> 00:08:40,379
An admin opens the Group policy
303
00:08:40,379 --> 00:08:41,659
Management console, creates a
304
00:08:41,659 --> 00:08:43,419
GPO, picks the settings, links
305
00:08:43,419 --> 00:08:44,740
it to the right folder, and
306
00:08:44,740 --> 00:08:45,679
waits for the machines to
307
00:08:45,679 --> 00:08:46,460
refresh.
308
00:08:46,460 --> 00:08:47,659
The hard part isn't creating it
309
00:08:47,659 --> 00:08:48,940
because the hard part is naming
310
00:08:48,940 --> 00:08:50,419
it clearly and remembering why
311
00:08:50,419 --> 00:08:51,059
it exists.
312
00:08:51,059 --> 00:08:54,460
Six months later, that same
power has a flip side, and the
313
00:08:54,460 --> 00:08:57,980
mistakes that cause the most
pain are predictable.
314
00:08:57,980 --> 00:08:59,539
The mistakes that trip people
up.
315
00:08:59,539 --> 00:09:02,539
Group policy is powerful enough
to cause real damage, and almost
316
00:09:02,539 --> 00:09:04,899
all of that damage comes from a
short list of habits.
317
00:09:04,899 --> 00:09:06,059
Sprawl is the most common.
318
00:09:06,059 --> 00:09:07,659
A company keeps adding Gpos one
319
00:09:07,659 --> 00:09:08,840
for every request until there
320
00:09:08,840 --> 00:09:10,019
are hundreds of overlapping
321
00:09:10,019 --> 00:09:11,169
rules, and nobody can predict
322
00:09:11,169 --> 00:09:12,250
what a given machine ends up
323
00:09:12,250 --> 00:09:12,730
with.
324
00:09:12,730 --> 00:09:15,529
Fewer policies with clear names
and a written purpose beat a
325
00:09:15,529 --> 00:09:16,809
giant pile every time.
326
00:09:16,809 --> 00:09:18,889
Speed is the next trap or the
lack of it.
327
00:09:18,889 --> 00:09:21,450
Too many policies, and
especially heavy logon scripts
328
00:09:21,450 --> 00:09:24,250
drag out startup and sign in
until people complain that their
329
00:09:24,250 --> 00:09:25,649
computer takes forever.
330
00:09:25,649 --> 00:09:28,210
Slow sign ins are one of the
most common complaints in
331
00:09:28,210 --> 00:09:31,250
windows environments, and
they're almost always fixable by
332
00:09:31,250 --> 00:09:32,769
trimming and consolidating.
333
00:09:32,769 --> 00:09:35,210
Then there's a loophole people
forget if a user is a local
334
00:09:35,210 --> 00:09:38,330
administrator and the GPO itself
hasn't changed, they can undo a
335
00:09:38,330 --> 00:09:41,169
setting, and windows won't put
it back until the gpos version
336
00:09:41,169 --> 00:09:44,250
changes, or the sixteen hour
security cycle runs.
337
00:09:44,250 --> 00:09:45,690
A local admin can win a fight.
338
00:09:45,690 --> 00:09:47,169
The policy thinks it already
won.
339
00:09:47,169 --> 00:09:48,850
One mistake has a real history
behind it.
340
00:09:48,850 --> 00:09:51,250
Admins used to push local
passwords through group policy
341
00:09:51,250 --> 00:09:54,210
preferences, and those passwords
were encrypted with a key that
342
00:09:54,210 --> 00:09:56,610
Microsoft accidentally
published, which meant anyone
343
00:09:56,610 --> 00:09:57,490
could read them.
344
00:09:57,490 --> 00:10:00,409
Microsoft removed that ability
back in May twenty fourteen with
345
00:10:00,409 --> 00:10:03,529
a fix called miss fourteen and
zero two five, but old stored
346
00:10:03,529 --> 00:10:06,529
values still turn up in systems
that were never cleaned up.
347
00:10:06,529 --> 00:10:09,610
The lesson is bigger than the
bug because a policy is never a
348
00:10:09,610 --> 00:10:10,970
safe place for a secret.
349
00:10:10,970 --> 00:10:12,240
Blocking inheritance is another
350
00:10:12,240 --> 00:10:13,840
one and it bites later, and
351
00:10:13,840 --> 00:10:15,120
admin blocks a folder to get a
352
00:10:15,120 --> 00:10:16,279
clean slate and accidentally
353
00:10:16,279 --> 00:10:17,399
cuts off a rule the business
354
00:10:17,399 --> 00:10:17,600
needs.
355
00:10:17,600 --> 00:10:18,960
Like a security baseline.
356
00:10:18,960 --> 00:10:21,159
Blocking is a sharp tool, and it
should come with a note about
357
00:10:21,159 --> 00:10:23,919
why testing is the step people
skip when they're busy.
358
00:10:23,919 --> 00:10:25,320
Apply a rule to everyone at
once.
359
00:10:25,320 --> 00:10:28,080
With no pilot group, and a
broken policy hits the whole
360
00:10:28,080 --> 00:10:29,720
company in a single morning.
361
00:10:29,720 --> 00:10:32,720
The safe habit is to test on a
small group, watch it for a day,
362
00:10:32,720 --> 00:10:34,320
and only then widen it out.
363
00:10:34,320 --> 00:10:35,519
And then there's documentation,
364
00:10:35,519 --> 00:10:36,840
which sounds boring until it
365
00:10:36,840 --> 00:10:37,440
isn't.
366
00:10:37,440 --> 00:10:38,620
The settings nobody remembers
367
00:10:38,620 --> 00:10:39,620
adding are the ones that cause
368
00:10:39,620 --> 00:10:39,960
trouble.
369
00:10:39,960 --> 00:10:42,840
Two years later, when the person
who set them has moved on.
370
00:10:42,840 --> 00:10:45,960
A short note on each GPO saves
hours of guessing.
371
00:10:45,960 --> 00:10:48,480
There's a trap in the other
direction, too, where a company
372
00:10:48,480 --> 00:10:51,840
tries to fix sprawl by cramming
everything into one giant GPO.
373
00:10:51,840 --> 00:10:54,200
That's worse, because now a
single mistake takes down every
374
00:10:54,200 --> 00:10:55,320
setting at once.
375
00:10:55,320 --> 00:10:56,919
AIM for small, focused policies
376
00:10:56,919 --> 00:10:58,440
grouped by purpose, so a change
377
00:10:58,440 --> 00:10:59,600
to one doesn't ripple through
378
00:10:59,600 --> 00:11:00,320
the rest.
379
00:11:00,320 --> 00:11:02,200
Where group policy stops working
380
00:11:02,200 --> 00:11:03,759
after all that, it's worth being
381
00:11:03,759 --> 00:11:05,000
honest about the edges, because
382
00:11:05,000 --> 00:11:06,039
knowing them is what makes you
383
00:11:06,039 --> 00:11:07,039
look like you know what you're
384
00:11:07,039 --> 00:11:07,679
doing.
385
00:11:07,679 --> 00:11:09,519
Group policy is client side.
386
00:11:09,519 --> 00:11:10,720
The computer pulls the rules
387
00:11:10,720 --> 00:11:12,000
down and the server doesn't push
388
00:11:12,000 --> 00:11:12,639
them out.
389
00:11:12,639 --> 00:11:14,669
A machine needs a working
connection to a domain
390
00:11:14,669 --> 00:11:16,230
controller to get fresh policy.
391
00:11:16,230 --> 00:11:17,429
So a laptop that's off the
392
00:11:17,429 --> 00:11:19,110
network for a long stretch keeps
393
00:11:19,110 --> 00:11:20,509
applying the last rules it knew
394
00:11:20,509 --> 00:11:20,990
about.
395
00:11:20,990 --> 00:11:22,990
It's also built for windows on a
domain.
396
00:11:22,990 --> 00:11:25,269
Macs, phones and tablets sit
397
00:11:25,269 --> 00:11:26,769
outside its reach, and so do
398
00:11:26,769 --> 00:11:27,909
machines that were never joined
399
00:11:27,909 --> 00:11:28,870
to the domain in the first
400
00:11:28,870 --> 00:11:29,389
place.
401
00:11:29,389 --> 00:11:31,190
The big one is the cloud devices
402
00:11:31,190 --> 00:11:32,330
that are joined only to
403
00:11:32,330 --> 00:11:33,950
Microsoft Entra ID, the cloud
404
00:11:33,950 --> 00:11:35,309
identity service once called
405
00:11:35,309 --> 00:11:36,350
Azure AD.
406
00:11:36,350 --> 00:11:38,029
Don't process group policy at
all.
407
00:11:38,029 --> 00:11:40,309
There's no domain controller in
that picture, so there's nothing
408
00:11:40,309 --> 00:11:41,909
for a GPO to attach to.
409
00:11:41,909 --> 00:11:43,629
It's not a monitoring tool
either.
410
00:11:43,629 --> 00:11:46,830
Group policy enforces settings,
and it doesn't tell you what
411
00:11:46,830 --> 00:11:49,710
people are doing or whether
anyone is misusing their access.
412
00:11:49,710 --> 00:11:52,750
People sometimes expect it to be
a security camera, and it isn't.
413
00:11:52,750 --> 00:11:54,029
There's also the timing limit we
414
00:11:54,029 --> 00:11:55,269
already covered between the
415
00:11:55,269 --> 00:11:57,070
refresh window and the two cycle
416
00:11:57,070 --> 00:11:57,549
quirk.
417
00:11:57,549 --> 00:11:58,950
Group policy is reliable, but it
418
00:11:58,950 --> 00:12:00,269
isn't instant, and treating it
419
00:12:00,269 --> 00:12:01,990
as instant is how you end up
420
00:12:01,990 --> 00:12:03,070
convinced it's broken when it
421
00:12:03,070 --> 00:12:03,590
isn't.
422
00:12:03,590 --> 00:12:04,909
None of that means it's going
away.
423
00:12:04,909 --> 00:12:07,429
Microsoft still treats group
policy as a core part of
424
00:12:07,429 --> 00:12:10,350
managing windows, and huge
numbers of organizations rely on
425
00:12:10,350 --> 00:12:11,230
it every day.
426
00:12:11,230 --> 00:12:12,870
The honest position is that it's
mature.
427
00:12:12,870 --> 00:12:14,700
It has firm edges and a newer
428
00:12:14,700 --> 00:12:15,980
tool now covers the ground it
429
00:12:15,980 --> 00:12:16,740
can't reach.
430
00:12:16,740 --> 00:12:18,419
Hybrid setups blur the line, and
431
00:12:18,419 --> 00:12:19,460
this is where a lot of beginners
432
00:12:19,460 --> 00:12:20,259
get stuck.
433
00:12:20,259 --> 00:12:21,399
A machine can be joined to a
434
00:12:21,399 --> 00:12:22,860
domain and enrolled in Intune at
435
00:12:22,860 --> 00:12:24,220
the same time, which means it
436
00:12:24,220 --> 00:12:25,419
can receive rules from both
437
00:12:25,419 --> 00:12:25,940
sides.
438
00:12:25,940 --> 00:12:28,600
That overlap is real, and it's
worth knowing about, because
439
00:12:28,600 --> 00:12:31,340
figuring out which side is
actually in charge is a normal
440
00:12:31,340 --> 00:12:32,779
part of hybrid work.
441
00:12:32,779 --> 00:12:34,980
How group policy fits with
Microsoft three hundred sixty
442
00:12:34,980 --> 00:12:35,860
five and Azure.
443
00:12:35,860 --> 00:12:37,299
If cloud devices don't use group
444
00:12:37,299 --> 00:12:38,820
policy, the cloud world has its
445
00:12:38,820 --> 00:12:40,299
own answer, and that answer is
446
00:12:40,299 --> 00:12:41,539
Microsoft Intune.
447
00:12:41,539 --> 00:12:43,580
The way the two connect is worth
understanding.
448
00:12:43,580 --> 00:12:44,980
Start with the identity side.
449
00:12:44,980 --> 00:12:47,899
Microsoft Entra ID does not
process group policy.
450
00:12:47,899 --> 00:12:48,740
Full stop.
451
00:12:48,740 --> 00:12:51,379
Group policy needs Active
Directory Domain services, the
452
00:12:51,379 --> 00:12:54,179
on premises system that has been
running domains for decades.
453
00:12:54,179 --> 00:12:57,019
So a device joined only to enter
ID is managed through Intune
454
00:12:57,019 --> 00:12:59,899
instead using something called
the settings catalog.
455
00:12:59,899 --> 00:13:01,299
The goal is the same in both
worlds.
456
00:13:01,299 --> 00:13:02,860
You still decide a setting and
457
00:13:02,860 --> 00:13:04,100
you still want it to reach the
458
00:13:04,100 --> 00:13:05,059
right machines.
459
00:13:05,059 --> 00:13:07,899
What changes is the engine and
where the rules live.
460
00:13:07,899 --> 00:13:09,539
Group policy targets by folder.
461
00:13:09,539 --> 00:13:12,340
So a device's location in the
domain decides who gets what.
462
00:13:12,340 --> 00:13:14,580
Intune targets by assignment to
people and groups.
463
00:13:14,580 --> 00:13:16,960
So it works for devices no
matter where they are.
464
00:13:16,960 --> 00:13:18,440
The bridge between the two is a
465
00:13:18,440 --> 00:13:19,759
tool called Group Policy
466
00:13:19,759 --> 00:13:21,320
Analytics, and it's built right
467
00:13:21,320 --> 00:13:22,080
into Intune.
468
00:13:22,080 --> 00:13:23,639
You export your existing Gpos,
469
00:13:23,639 --> 00:13:25,000
import them, and Intune reports
470
00:13:25,000 --> 00:13:26,279
back which settings are
471
00:13:26,279 --> 00:13:27,799
supported in the cloud and which
472
00:13:27,799 --> 00:13:28,559
ones aren't.
473
00:13:28,559 --> 00:13:30,799
It turns a vague worry into a
clear list.
474
00:13:30,799 --> 00:13:33,720
Then the migrate feature takes
the supported settings and turns
475
00:13:33,720 --> 00:13:36,440
them into an Intune settings
catalog policy you can assign to
476
00:13:36,440 --> 00:13:37,799
your cloud devices.
477
00:13:37,799 --> 00:13:38,639
The settings that aren't
478
00:13:38,639 --> 00:13:39,919
supported have to be rebuilt
479
00:13:39,919 --> 00:13:41,000
another way or dropped on
480
00:13:41,000 --> 00:13:41,679
purpose.
481
00:13:41,679 --> 00:13:44,399
Either way, you know, instead of
guessing, there's one warning
482
00:13:44,399 --> 00:13:47,080
here because it's the mistake
this whole migration invites.
483
00:13:47,080 --> 00:13:49,960
Don't copy every GPO into Intune
one for one, since that just
484
00:13:49,960 --> 00:13:51,840
moves old clutter to a new home.
485
00:13:51,840 --> 00:13:55,080
The point of the analytics step
is to migrate only the settings
486
00:13:55,080 --> 00:13:56,480
that still earn their place.
487
00:13:56,480 --> 00:13:57,879
Group policy also still lives
488
00:13:57,879 --> 00:13:59,080
inside Azure in a couple of
489
00:13:59,080 --> 00:13:59,799
places.
490
00:13:59,799 --> 00:14:02,600
Microsoft Entra Domain Services,
a managed domain service in the
491
00:14:02,600 --> 00:14:05,159
cloud, does support group
policy, so you can use it for
492
00:14:05,159 --> 00:14:06,759
machines joined to that domain.
493
00:14:06,759 --> 00:14:09,840
Azure Virtual Desktop is the
other one where hosts join to a
494
00:14:09,840 --> 00:14:12,940
traditional domain still follow
group policy while cloud joined
495
00:14:12,940 --> 00:14:14,600
hosts follow Intune.
496
00:14:14,600 --> 00:14:17,470
In both cases, the rule is
simple because how the device is
497
00:14:17,470 --> 00:14:19,350
joined decides how it's managed.
498
00:14:19,350 --> 00:14:20,710
Microsoft's own message here is
499
00:14:20,710 --> 00:14:21,809
coexistence rather than a
500
00:14:21,809 --> 00:14:22,509
cutover.
501
00:14:22,509 --> 00:14:25,830
Group policy still runs a huge
share of enterprise windows, and
502
00:14:25,830 --> 00:14:29,110
Intune picks up the devices that
never touch a domain.
503
00:14:29,110 --> 00:14:31,950
Learning one teaches you most of
the other because the thinking
504
00:14:31,950 --> 00:14:32,830
is the same.
505
00:14:32,830 --> 00:14:33,750
The practical path most
506
00:14:33,750 --> 00:14:35,269
companies take is phased rather
507
00:14:35,269 --> 00:14:36,269
than sudden.
508
00:14:36,269 --> 00:14:38,509
They run group policy and Intune
side by side.
509
00:14:38,509 --> 00:14:41,269
Move one group of devices at a
time and keep the on premises
510
00:14:41,269 --> 00:14:43,389
rules alive for the machines
that still need them.
511
00:14:43,389 --> 00:14:44,509
Nothing has to happen all at
512
00:14:44,509 --> 00:14:45,669
once, which is good news if
513
00:14:45,669 --> 00:14:46,509
you're learning this for the
514
00:14:46,509 --> 00:14:48,110
first time.
515
00:14:48,110 --> 00:14:50,230
The short version and a question
for you.
516
00:14:50,230 --> 00:14:52,750
The whole thing comes down to
one simple picture.
517
00:14:52,750 --> 00:14:55,429
Group policy is a central rule
sheet for windows computers.
518
00:14:55,429 --> 00:14:57,909
And when rules collide, the one
closest to the person or
519
00:14:57,909 --> 00:14:59,429
computer usually wins.
520
00:14:59,429 --> 00:15:00,629
Changes arrive on a schedule
521
00:15:00,629 --> 00:15:02,070
rather than instantly, and
522
00:15:02,070 --> 00:15:03,309
devices that live only in the
523
00:15:03,309 --> 00:15:04,629
cloud are managed by Intune
524
00:15:04,629 --> 00:15:05,110
instead.
525
00:15:05,110 --> 00:15:06,350
So here's my question for you.
526
00:15:06,350 --> 00:15:09,590
Which setting on your own work
computer do you now suspect came
527
00:15:09,590 --> 00:15:10,509
from group policy?
528
00:15:10,509 --> 00:15:11,870
If this made the topic feel less
529
00:15:11,870 --> 00:15:14,330
intimidating, subscribe to M365
530
00:15:14,330 --> 00:15:16,029
FM to master the tools and the
531
00:15:16,029 --> 00:15:17,470
mindset shaping the future of
532
00:15:17,470 --> 00:15:18,149
work.
