Two tools with similar names do opposite jobs. Policies enforce: the user cannot change the setting, and it vanishes when the GPO falls away. Preferences suggest: the setting arrives as a default the user may change — and it stays even after the GPO is gone. That staying power has a name: tattooing.
Open the Group Policy editor and you will find two worlds living side by side: Policies (under Administrative Templates, and most of Windows Settings → Security Settings) and Preferences (under Windows Settings and Control Panel Settings in each half). Beginners treat them as synonyms. They are not — they differ in enforcement, in what happens when the user fights back, and most importantly in what happens when the GPO stops applying. That last difference, tattooing, is the one that leaves permanent marks on PCs years after the GPO was deleted.
Example — same intention, opposite afterlife. Choose with the removal day in mind, not just the rollout day.
True policy settings write to the protected Policies branches of the registry. Three consequences follow. The setting is enforced: the corresponding option in Windows is greyed out, and even a local admin's casual tweak inside the app does nothing — the policy reasserts itself at every refresh. The setting is honest about scope: move the account out of the OU, unlink or delete the GPO, and the setting is removed at the next refresh, returning the machine to its natural state. And the setting does not tattoo — it never becomes a permanent leftover. For rules — security baselines, blocked features, compliance settings — this is exactly the behaviour you want, which is why policies are the default choice for anything that must be true.
Preferences (GPP) were built for everything policy cannot do: drive mappings, printer connections, shortcuts, files, registry values, scheduled tasks, power options and more. They are applied with the same machinery, but they are defaults, not laws — where the underlying thing can be changed by the user, the user may change it (until the next refresh re-applies it, unless you tick Apply once and do not reapply). And they write to the normal, non-policy registry locations — which is why, when the GPO falls out of scope, Preferences stay behind. That is tattooing: the drive map, the registry value, the power plan remain on the PC indefinitely, invisible to any GPO report, until someone removes them deliberately.
Preferences do offer an escape hatch per item: Remove this item when it is no longer applied. With it ticked, falling out of scope deletes the item again — nearly policy-like behaviour. Without it, tattoo.
Each Preferences item can carry its own targeting conditions — this OU, that security group, this OS version, laptops only (battery present), a certain IP range, a file that exists — combined with AND/OR logic, chosen from friendly menus. One GPO can therefore deliver five different drive maps to five different teams, each item firing only for its audience. Policies have nothing like this built in (their targeting is per-GPO: link, security filter, WMI filter). When your requirement sounds like "same container, but different settings for different sub-groups, all in one place", Preferences with item-level targeting is usually the cleanest answer in all of Group Policy.
The mistake to avoid is using Preferences for security rules because they were easier to find in the editor. A security rule a user can undo is not a rule — and a tattooed one you cannot cleanly retract is worse.
Every mature domain has tattooed settings from Preferences deleted years ago. They surface as ghosts: a drive letter that reappears though no GPO maps it, a proxy value nobody owns. The honest cleanup is manual and targeted — a one-time script or a new Preference set to Delete for the orphaned item, applied once, then removed. Going forward, keep a simple register of every Preference you deploy with its cleanup option ticked or not; the register is boring, and that is precisely why it works. Policies never need this paperwork — another reason law beats suggestion when the setting actually matters.
User policy and computer policy explained live on a real domain controller — create, link and test your first GPO with the video.
▶️ Watch Full VideoIt means a setting stays on the PC even after the GPO that delivered it is removed or no longer applies. Group Policy Preferences tattoo by default because they write to normal registry locations; true policies do not, because they live in the protected Policies branches and are cleaned up automatically.
Generally yes — Preferences deliver defaults, and where Windows allows the change, the user can change them (the preference will normally re-apply at the next refresh unless it was set to apply once). Settings delivered as policies are locked and greyed out instead.
Open the item's Common tab and tick 'Remove this item when it is no longer applied'. The item will then be deleted from machines that fall out of scope, instead of tattooing them.