In this video from ITFreeTraining I will look at the different Group Policy types, of which
there are 3. Understanding what these are used for will help you later on in the course
when more advanced topics are covered.
The 3 group policy types are, local, NonLocal and starter. Local GPOs (GPO stands for Group
Policy Object) are Group Policies that apply to the local computer only. These are also
referred to as LGPO which stands for Local Group Policy Object.
NonLocal GPOs are essentially Group Policies that are stored in Active Directory and deployed
to computers in the domain.
Starter GPOs are essentially a GPO template that you can use to create other GPOs. Let’s
have a look at each one in more detail.
Local Group Policy applies only to the local computer. The advantage of local Group Policy
is that the computer does not need to be in the domain. This means there is no central
control so the administrator will need to visit each computer in order to apply Group
Policy. To make the process easier, once a computer has been configured, the administrator
can export the Group Policy and import it on another computer.
After Windows 2008 R2 and Windows Vista, multiple local Group Polices are supported. However,
the additional group policies can be applied only to users. It is not possible to create
multiple local Group Policies for the same computer.
To have a look at the local group policy on this computer, I will right click on the start
menu and then select run from the menu. If I enter in GPEdit.MSC, this will run the local
Group Policy editor. You can also add it in an MMC console. To do this, I will run MMC
from the run menu.
Once MMC has started, I will run “Add/Remove Snap-in” from the file menu. From the available
snap-ins I will select “Group Policy Object Editor”. Since I have RSAT installed on
this computer, there are also additional Group Policy Snap-ins that would not normally be
present, but “Group Policy Object Editor” will always be present.
Once I press add, the snap-in will be added and I will be asked which local Group Policy
I want to edit. By default, you can see that the Group Policy is configured to edit the
Local Computer. If I press the browse button, I get the option to change the computer that
I want to edit.
If I select the Users tab, I can select which user’s Group Policy I want to edit. Currently
there are no additional Local Group Polices. If you wanted to, you could create a Group
Policy for just administrators and another one just for “Non-Administrators”.
I will now exit out of this screen and add Group Policy Object Editor to MMC. Once added,
notice that I can expand and see all the Local Group Policy settings that can be configured.
In later videos I will have a look at how to configure some of these settings.
The next Group Policy type is NonLocal GPOs. This is Group Policy which is stored in Active
Directory. Since it is stored in Active Directory it is replicated to all other Domain Controllers.
This makes it easy for the administrator to control and deploy Group Policy in their domain.
For this to occur, each computer needs to be a member of the domain.
The advantage of NonLocal GPOs, which I will often just refer to as Group Policy, is that
multiple Group Policies can be applied. There is an order in which they are applied so that
when conflicts occur there is a predictable way that the settings are applied. In a later
video, I will go through the order that they are applied in.
These multiple group policies can be applied to both users and computers. NonLocal GPOs
provide the easiest way for the administrator to manage computers and users in the domain.
The last Group Policy type is Starter GPOs. These were introduced in Windows Server 2008.
These are essentially a template of Group Policy settings. When a new NonLocal GPO is
created, you have the option to create the Group Policy Object from the starter GPO.
This new Group Policy Object will start with all the settings from the starter GPO. The
administrator is free to change any of these settings as they see fit.
That covers it for all the different types of Group Policy supported by Windows. I hope
you have found this video useful and I hope to see you in other videos from us. Until
next time, thanks for watching.