Mastering Windows Group Policy

Self-regulating policies

Most policy settings that exist inside Administrative Templates by default (the ones baked into Windows when you build a Domain) have the ability to self-regulate, or to self-remove when the policy is no longer applied to a machine. When you tweak a setting inside Administrative Templates, and that GPO then filters down and applies to a workstation, what you are really doing on that client machine is modifying a registry key that lives in a special section of the registry that is unavailable to the users, so they can't edit these settings. That makes sense and lines up with everything we have learned so far, as soon as a GPO has settings and the client computer does a background refresh, those settings are put into ...