QUARTER 2

LO 2: CONFIGURE NETWORK
SERVICES
SELF- LEARNING MODULE 11
Understanding Group Policy
Object (GPO)
Writer: Ms. Virgie Alfaras Baylon
Reviewer: Mr. Cyrus N. Caruz
Introductory Message

For the facilitator:

Welcome to the (Computer System Servicing(CSS) Grade-12) Self Learning Module

on (Understanding Group Policy Object (GPO)) !
This Self Learning Module was collaboratively designed, developed and reviewed by
educators from Schools Division Office of Pasig City headed by its Officer-In-Charge
Schools Division Superintendent, Ma. Evalou Concepcion A. Agustin in partnership
with the Local Government of Pasig through its mayor, Honorable Victor Ma. Regis
N. Sotto. The writers utilized the standards set by the K to 12 Curriculum using the
Most Essential Learning Competencies (MELC) while overcoming their personal,
social, and economic constraints in schooling.

This learning material hopes to engage the learners into guided and independent
learning activities at their own pace and time. Further, this also aims to help
learners acquire the needed 21st century skills especially the 5 Cs namely:
Communication, Collaboration, Creativity, Critical Thinking and Character while
taking into consideration their needs and circumstances.

In addition to the material in the main text, you will also see this box in the body of
the module:

Notes to the Teacher

This contains helpful tips or strategies
that will help you in guiding the learners.

As a facilitator you are expected to orient the learners on how to use this module.
You also need to keep track of the learners' progress while allowing them to
manage their own learning. Moreover, you are expected to encourage and assist the
learners as they do the tasks included in the module.
 EXPECT AT ION

After completing the lesson the learners should be able to:

A. Understand Group Policy Object (GPO) in the server network;

B. Know the limitations and benefits of Group Policy Object (GPO); and
C. Explain the effect of GPO in Windows settings and Control Panel

PRET EST

Directions: Read each statement below carefully. Write T if the statement is

correct and F if wrong in the space provided before each number.

______1. Administrative Templates of the Computer node, we see some of the same
folders plus some additional ones, such as Shared Folders, Desktop, Start
Menu and Taskbar.

______2. A Group Policy object (GPO) is a collection of Group Policy settings that
define what a system will look like and how it will behave for a defined
group of users.

______3. Administrative Templates of the user node, we discover Windows

Components, System, Network and Printers.

______4. Group Policy provides a method of centralizing configuration settings and

management of operating systems, computer settings and user settings in
a Microsoft IT environment.

______5. Every GPO contains two parts, or nodes.

 ..

RECAP

Directions: Find the steps on how to go to the following screen below:

(Select the letter of the correct answer on the box)

a. Point to Administrative Tools d. Right click on domain name

b. Click Start e. Click New
c. Click Active Directory Users and Computers f. Click Organizational Unit

To start the Active Directory Users and Computers snap-in:

1. ___________________________
2. ___________________________
3. ___________________________

To create Organization Unit

4. __________________________ Css-ict.com

5. __________________________
6. __________________________
 LESSON

WHAT IS GROUP POLICY OBJECT (GPO)

Group Policy provides a method of centralizing configuration settings and

management of operating systems, computer settings and user settings in a
Microsoft IT environment. Group Policy is a twofold idea: Local Group Policy on
individual workstations and Group Policy in Active Directory.
Group Policy Objects (GPOs)
A Group Policy object (GPO) is a collection of Group Policy settings that define what
a system will look like and how it will behave for a defined group of users. Every
GPO contains two parts, or nodes: a user configuration and a computer
configuration. The first level under both the User and the Computer nodes
contains Software Settings, Windows Settings and Administrative Templates. If we
dive down into the Administrative Templates of the Computer node, we discover
Windows Components, System, Network and Printers. Likewise, if we dive down
into the Administrative Templates of the User node, we see some of the same
folders plus some additional ones, such as Shared Folders, Desktop, Start Menu
and Taskbar. The Computer node contains policy settings that are relevant only
for computers. That is, if a GPO that contains Computer settings “hits” a computer,
those settings will take effect. These Computer settings could be startup scripts,
shutdown scripts, and setting that control how the local firewall should be
configured. Every setting is relevant to the computer itself, no matter who is logged
on at a given moment. The User node contains policy settings that are relevant
only for users. Again, if a GPO contains User settings “hits” a user, those settings
will take effect for that user. User settings make sense only on a per-user basis,
like logon scripts, logoff scripts and availability of the Control Panel. Think of this
as every setting relevant to the currently logged-on user; these settings follow the
user to every machine they use.
https://cdn.ttgtmedia.com/rms/onlineimages/whatis-group_policy_object-f.png

BENEFITS OF GROUP POLICY OBJECTS

There are several benefits to implementing GPOs in addition to security, including:
1. More efficient management - GPOs already in place apply a standardized
environment to all new users and computers that join an organization’s
domain, saving time on setup.
2. Ease of administration - system administrators can deploy software, patches
and other updates via GPO.
 3. Better password policy enforcement - GPOs determine password length, reuse
rules and establish other requirements for passwords to keep a company’s
network safe.
4. Configuring folder redirection - GPOs enable companies to ensure users are
keeping important company files on a centralized and monitored storage
system. For instance, an organization can redirect a user’s Documents folder,
which is usually stored on a local drive, to a network location.
LIMITATIONS OF GPOS
The limitations of Group Policy Objects include:
1. They run sequentially - GPOs process actions one after another. Consequently,
if many GPOs have to be configured, it can take a long time for users to log on.
2. Flexibility is limited - GPOs can only be applied to users or computers. So
they’re limited when it comes to applying settings based on context.
3. Limited triggers - GPOs can only be applied at computer startup, when a user
logs on or at set intervals. GPOs can’t react to changes in environment, such as
network disconnect or reconnect.
4. Difficult to maintain - there’s no built-in search or filter option to find a specific
setting within a GPO, making it difficult to find or fix issues with existing
settings.
5. No version control - changes made to GPO settings aren’t audited. So if an
incorrect change is made, it’s impossible to tell what the change was or who
made it.
EXAMPLES OF GPOS
The following are examples of Group Policy Objects:
 A GPO might specify the home page that’s first displayed when a user
launches Internet Explorer. When the user logs on to the domain, that group
policy object is retrieved and applied to the configuration of the user’s Internet
Explorer.
 An organization can deploy shared network printer connections to users from a
specific OU of Active Directory by using Group Policy. So when a user logs in to
Windows, an assigned network printer will automatically appear in the list of
available printers.
 Admins can use a group policy to adjust settings, such as turning off computer
displays are a certain period of time, choosing default programs and preventing
users from changing Internet connection options.
WINDOWS SETTINGS
The Windows settings directly affect Windows. The following extensions are
available:
 Environment — Lets you set specific Environment variables based on certain
conditions and then call those variables. In particular, you can:
 Set user and system Environment variables. For instance, you can define set
the variable HRFILES to the value C:\Documents\HRFILES, and use that
variable in GPPrefs to read or copy HR files without the need to enter a full
path each time.
 Update the Windows system path variable.
 Files — Lets you copy files from point A to point B. Point A can be a UNC path or
the local machine. The most common scenario is to copy a file from a share on a
server to a user’s My Documents folder, the desktop, or C:\ drive.
 Folders — Lets you create new folders and delete existing folders or wipe out their
contents. For example, you could delete the contents of the %HRFILES% folder
each day.
 Registry — Lets you send certain registry settings to your client machines. This is
a very powerful extension that can also be a little hard to operate. You can send
registry settings normally designed for Users to both HKLM and HKCU containers.
And you can send registry settings normally designed for computers to the HKLM
container.
 Network Shares — Allows you to create new shares on workstations or servers, or
to delete existing shares.
 Shortcuts — Allows you to create both program and URL shortcuts on desktops, in
the Startup folder, the Programs folders and a lot of other locations.

CONTROL PANEL SETTINGS

Here are the extensions in the Control Panel node:

1. Data Sources - Lets you set connections to Open Database Connectivity (ODBC)
data sources via Group Policy.
2. Devices - Enables you to disable a single device or device class.
3. Folder Options - Lets you associate a file extension with a particular class.
4. Local Users and Groups - Enables you to add or remove users from groups,
change users’ passwords, lock out accounts, and set password expirations.
5. Network Options - Allows you to configure the following connection types:
6. Virtual private network (VPN) connections
7. Dial-up networking (DUN) connections
8. Power Options - Allows you to manage Power settings. You can set things like the
hard disk spin downtime or how long until the monitor goes into standby mode.
9. Printers - Allows you to manage shared printers.
10. Scheduled Tasks - Enables you to set scheduled tasks.
11. Services - Enables you to manage just about every aspect of a client computer’s
services. This is especially useful if the target is a server machine and you have one
service that’s running on multiple machines but you haven’t gotten around to
changing the service account.
12. Internet Settings - Lets you specify Internet Explorer settings.
13. Regional Options - Enables you to change local settings depending on who the
user is.
14. Start Menu - Provides a very easy way to make changes to the Start menu.
 ACT IVIT IES

IDENTIFICATION: Identify the following statement write the answer on the space
provided.

1. ___________________ In windows settings it allows you to create new shares on

workstations or servers, or to delete existing shares.
2. ___________________ In Control Panel settings it Lets you set connections to
Open Database Connectivity (ODBC) data sources via Group Policy.
3. ___________________ In Control Panel settings it enables you to change local
settings depending on who the user is.
4. ___________________ In windows settings it lets you copy files from point A to
point B. The most common scenario is to copy a file from a share on a server to
a user’s My Documents folder, the desktop, or C:\ drive.
5. ___________________ In Control Panel settings it allows you to manage Power
settings. You can set things like the hard disk spin downtime or how long until
the monitor goes into standby mode.
6. ___________________ In Control Panel settings it allows you to manage shared
printers.
7. ___________________ In windows settings it lets you create new folders and delete
existing folders or wipe out their contents.
8. ___________________ In Control Panel settings enables you to manage just about
every aspect of a client computer’s services.
9. ___________________ In windows settings it lets you send certain registry settings
to your client machines.
10. ___________________In Control Panel settings it enables you to disable a single
device or device class.

WR AP UP

GROUP POLICY OBJECT (GPO)

Processing order of GPOs
The processing order of Group Policies effects what settings are applied to the
computer or end-user. This processing order is known as LSDOU: local, site,
domain, organization unit. First the local computer policy is processed, followed by
Active Directory policies from site level to domain, then into OU (GPOs in nested
organizational units apply from the OU closest to the root first, and continues from
there). If there are any conflicts, the last applied policy will take effect.
Best practices for GPOs

1. Create a well-designed organizational unit structure in Active Directory to

simplify applying and troubleshooting Group Policy.
2. Give GPOs descriptive names to enable admins to quickly identify what each
GPO does.
3. Add comments to each GPO explaining why it was created, what its purpose is
and what its settings are.
4. Don’t set GPOs at the domain level because they’ll be applied to all computer
and user objects. That could cause some settings to be applied to some objects
unnecessarily.
5. Don’t use the root computers or user folders in Active Directory because they’re
not organizational units and they can’t have GPOs linked to them. When a new
user or computer object appears in these folders, it should be immediately to
the appropriate OU.
6. Don’t disable a GPO. Rather, delete the link from an OU instead of disabling
the GPO if you don’t want it to be applied. Disabling the GPO will prevent it
from being applied entirely on the domain. That could be a problem because if
that particular Group Policy is used in another OU, it won’t work there any
longer.

VALUI NG

We have learned that Group Policy Object (GPO) has some benefits and limitations
briefly discuss some of them.

__________________________________________________________________________________
__________________________________________________________________________________
__________________________________________________________________________________
__________________________________________________________________________________
__________________________________________________________________________________
__________________________________________________________________________________
__________________________________________________________________________________
__________________________________________________________________________________
__________________________________________________________________________________
__________________________________________________________________________________
__________________________________________________________________________________
 POST T EST

Directions: Write WS if the statement is from Windows Settings and CPS if

Control Panel Settings in the space provided before each number.

_______ 1. Let you set specific Environment variables based on certain conditions
and then call those variables.
________2. Allows you to create both program and URL shortcuts on desktops, in
the Startup folder, the Programs folders and a lot of other locations.
_______ 3. Enables you to set scheduled tasks.
________4. Allows you to configure the following connection types: Virtual private
network (VPN) connections and Dial-up networking (DUN) connections
_______ 5. Allows you to create both program and URL shortcuts on desktops, in
the Startup folder, the Programs folders and a lot of other locations.
_______ 6. Let you specify Internet Explorer settings.
________7. Enables you to add or remove users from groups, change users’
passwords, lock out accounts, and set password expirations.
_______ 8. Enables you to disable a single device or device class.
_______ 9. Allows you to create new shares on workstations or servers, or to delete
existing shares.
_______ 10. Let you copy files from point A to point B. Point A can be a UNC path or
the local machine.

K EY T O CORRECT ION
Pre-test Recap Activity Post-test
1. F 1. b 1. Network Shares 1. WS
2. T 2. a 2. Data Sources 2. WS
3. F 3. c 3. Regional Option 3. CPs
4. T 4. d 4. Files 4. CPs
5. T 5. e 5. Power Option 5. WS
6. f 6. Printers 6. CPs
7. Folders 7. CPs
8. Services 8. CPs
9. Registry 9. WS
10. Devices 10. WS

R E F E R E N CE S
Online Sites:
(access August 6, 2020)
https://searchwindowsserver.techtarget.com/definition/Group-Policy-
Object#:~:text=Introduced%20in%20Windows%20Server%202008,future%20policy%20to%20be%20cr
eated.
https://blog.netwrix.com/2017/02/17/group-policy/
Image
(access August 6, 2020)
https://cdn.ttgtmedia.com/rms/onlineimages/whatis-group_policy_object-f.png