Mastering Windows Group Policy

Disabling half of a GPO

One controversial option that exists for every Group Policy Object is the ability to disable half of its settings. Namely, you can easily select to disable the entire set of computer settings (allowing only the user settings to work), or you can disable all user settings (which allows only computer settings within the GPO to function). The purpose of this capability is to speed up Group Policy processing when a machine boots or a user logs in. Oftentimes, we create GPOs with specific purposes in mind. Usually, the settings that we plug into a GPO are only ever going to be on one side of the house or the other. It is quite rare that you would create a GPO that contains both user and computer settings; typically, you ...