Active Directory GPO Full Tutorial ⚡ User & Computer Policy Explained

What a GPO Actually Is

A GPO is simply a named bundle of settings. It does nothing by itself. It starts working only when you link it to a container — a site, the domain, or an Organisational Unit (OU) — and it then applies to the user or computer accounts inside that container.

Two facts follow from this. First, editing a GPO and linking a GPO are two separate jobs; a perfectly configured GPO that is not linked anywhere changes nothing. Second, one GPO can be linked to several OUs, and one OU can receive many GPOs.

Everything in this tutorial happens in one console — the Group Policy Management Console. Open it on the domain controller, or on any PC with the RSAT tools installed, from the Run box:

gpmc.msc

Computer Policy vs User Policy — the Two Halves

Open any GPO and you will see the same two sections: Computer Configuration and User Configuration. They are not two views of one list — they are two different toolboxes with different settings, applied at different times to different accounts.

Computer Configuration applies to the computer account. It is processed when the PC starts, before anyone logs on. Software installation for machines, startup scripts, USB blocking, Windows Update behaviour and security settings live here.

User Configuration applies to the user account. It is processed when a user logs on, on any PC. Wallpapers, drive mappings, folder redirection, logon scripts and Control Panel restrictions live here.

Where You Link Decides Who Gets It

GPOs link at three levels: site (a physical office location), domain (everyone), and OU (one department or group). In small and medium offices almost all linking happens at OU level, because you first organise accounts into OUs — one for office PCs, one for staff users, one for laptops, and so on.

The two GPOs that exist by default — Default Domain Policy (password and account rules) and Default Domain Controllers Policy — are best left mostly alone. Create your own GPOs for your own settings, so you can switch them off without touching the defaults.

Create, Configure and Link Your First GPO

In gpmc.msc, right-click Group Policy Objects → New → give it a name that says what it does, like Block-USB-Drives. Naming honestly matters: after six months an office has forty GPOs, and names like "New GPO" or "test2" tell you nothing — name by job, not by date.

Right-click the new GPO → Edit. The editor opens with the two halves. Configure your settings in the correct half and close the editor.

Back in GPMC, right-click the target OU → Link an Existing GPO → select your GPO. On the client PC, restart it (for computer settings) or log off and back on (for user settings) — or force the refresh with the commands in the next step.

Force It and Prove It — gpupdate and gpresult

Policies refresh on their own roughly every 90 minutes (with a random offset), but nobody tests that slowly. On the client PC, open Command Prompt and run:

gpupdate /force
gpresult /r
gpresult /h report.html

gpupdate /force reapplies all policies now. Some settings still honestly need a restart (computer settings, software installs) or a fresh logon (user settings) — /force cannot skip physics.

gpresult /r is the receipt: it lists exactly which GPOs applied to the computer and to the user, and which were filtered out and why. For a readable report, gpresult /h report.html creates an HTML page showing every winning setting and which GPO it came from. Never judge a GPO by hope — gpresult /r should be the first command you run whenever a policy "does not work".