Group policy and Active Directory: Windows in the company

In short: Active Directory manages users, computers and rights centrally; group policies determine how Windows computers and users are set up.

In more detail: In a company with hundreds of workstations it would be impossible to configure every computer individually. Microsoft’s Active Directory (AD) is a directory service in which accounts, computers, groups and policies are stored. With group policy objects (GPOs), settings are distributed automatically to all matching computers and users.

In Depth

Building blocks of Active Directory

• Domain: administrative unit with a shared directory, such as company.local.
• Domain controller (DC): servers that hold the directory and check sign-ins (Kerberos, LDAP). Several DCs back each other up.
• Organizational units (OU): folders in the directory for structuring users and computers.
• Groups: collections of accounts to which rights are assigned. Users sign in with the same account at every company computer.

Group policies

A GPO is a set of settings linked to a domain or OU. Examples: password rules, screen lock after 10 minutes, mapping drives, providing printers, distributing software, blocking USB sticks, Windows update times. Order of application: local, site, domain, OU (later ones are stronger unless “enforced”). gpupdate /force applies again, gpresult /r shows what applies.

Rights and security

Rights are assigned to groups, not to individual people (AGDLP principle: accounts → global groups → domain local groups → permissions). The account with domain admin rights deserves special protection since it may do everything. Typical attacks use weak service accounts (Kerberoasting) or stolen credentials to spread through the network. Tiered admin accounts and monitoring are standard.

Alternatives

In cloud environments Microsoft Entra ID (formerly Azure AD) takes over the role for sign-in and device management (with Intune instead of GPO). On Linux and in mixed environments there are OpenLDAP, FreeIPA or Samba as an AD-compatible domain.

See also: LDAP, Kerberos, Windows Server, Windows registry