Disabling half of a GPO

One controversial option that exists for every Group Policy Object is the ability to disable half of its settings. Namely, you can easily select to disable the entire set of computer settings (allowing only the user settings to work), or you can disable all user settings (which allows only computer settings within the GPO to function). The purpose of this capability is to speed up Group Policy processing when a machine boots or a user logs in. Oftentimes, we create GPOs with specific purposes in mind. Usually, the settings that we plug into a GPO are only ever going to be on one side of the house or the other. It is quite rare that you would create a GPO that contains both user and computer settings; typically, you ...

Get Mastering Windows Group Policy now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.