Group Policy & Local Security Policy

Chapter 1 named Group Policy as the layer for "enforcing a setting consistently across many machines," available only on Pro/Enterprise/Education. Chapter 4 revealed what it actually does underneath: write the same Registry values a manual edit could set by hand. This chapter covers the tool itself — on the machines where it exists — plus a genuinely important scope rule Chapter 1 only gestured at.

gpedit.msc — The Local Group Policy Editor

Local Group Policy splits into two halves: Computer Configuration (settings applying to the machine itself, regardless of who signs in) and User Configuration (settings applying to whichever user is currently signed in). Both branch further into Windows Settings and Administrative Templates — the most commonly used node, exposing hundreds of settings as friendly toggles and dropdowns, each one ultimately writing to a specific Registry key exactly like Chapter 4's own manual example.

Local Security Policy — A Filtered View, Not a Separate System

secpol.msc isn't a genuinely separate tool — it's effectively a filtered view showing only the Computer Configuration > Windows Settings > Security Settings branch of the exact same Group Policy tree, presented on its own for convenience. Account Lockout Policy, Password Policy, Audit Policy, and User Rights Assignment all live here, covering security-specific configuration without needing to navigate the full gpedit.msc tree to reach them.

Applying & Verifying — gpupdate and gpresult

Policy changes apply automatically on a background refresh cycle (roughly every 90–120 minutes, with a randomized offset to avoid every machine in an organization refreshing simultaneously) — or immediately, via gpupdate /force, useful when testing a change rather than waiting. gpresult /h report.html generates a full, browsable report of exactly which policies are currently applied to this machine and — critically in a domain environment — precisely which Group Policy Object each one came from.

Domain vs. Local Scope — Resolving Chapter 1's Own Distinction

Local Group Policy applies only to the one machine it's configured on. In a domain-joined environment, centrally managed Group Policy Objects (GPOs) apply from Active Directory across many machines at once — and, critically, domain GPOs take precedence over local policy by default whenever the two conflict.

Hands-On Exercises