Security Strategies in Windows Platforms and Applications, 3rd Edition

Types of GPOs in Active Directory

Although defining local GPOs provides positive control over single computers, the real power of Group Policy is in AD. Defining GPOs in AD gives you the ability to centralize security rules and control how Windows applies each rule. You create AD GPOs on a domain controller. Windows stores GPOs in AD in such a way that the domain controller automatically replicates the GPOs to other domain controllers. This feature reduces the workload of administrators. Using Group Policy in AD relieves the need to define security rules on multiple computers one at a time.

Group Policy Management Console

AD GPOs are created on the domain controller using the Group Policy Management Console (GPMC) (FIGURE 6-6). Note that ...