Group Policy Configuration & Testing Guide

This guide walks through creating, linking, and testing Group Policy Objects (GPOs) in your Active Directory domain. You'll learn how to configure security baselines, user preferences, and drive mappings while troubleshooting common issues.

Step 1: Create and Link Computer Baseline GPO

We'll create a GPO targeted at workstations in a specific Organizational Unit (OU).

Target: Workstations > NYC (or parent Workstations for domain-wide application)

1. Open Group Policy Management.
2. Expand lab.local > Workstations and right-click NYC.
3. Select Create a GPO in this domain, and Link it here....
4. Name it GPO_NYC_Workstations_Baseline.

Step 2: Configure Interactive Logon Banner & Power Settings

1. Right-click GPO_NYC_Workstations_Baseline and click Edit.
2. Navigate to:

   Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options

3. Configure the banner:
   • Interactive logon: Message text for users attempting to log on → "Authorized Access Only. All activity in the NYC domain is monitored."
   • Interactive logon: Message title for users attempting to log on → "NYC Lab Security Notice"
4. Navigate to:

   Computer Configuration > Policies > Administrative Templates > System > Power Management

5. Enable Turn off hybrid sleep to prevent lab VMs from entering deep sleep during testing.

Step 3: Link User Policy for NYC Employees

Create a user policy that maps network drives and applies restrictions.

Target: Lab_Accounts > Employees > NYC

1. In Group Policy Management, navigate to Lab_Accounts > Employees > NYC.
2. Right-click NYC → Create a GPO in this domain, and Link it here....
3. Name it GPO_NYC_User_Preferences.

Configure Drive Mapping and Restrictions

1. Right-click GPO_NYC_User_Preferences and Edit.
2. Drive Mapping: Navigate to:

   User Configuration > Preferences > Windows Settings > Drive Maps

   • Map S: to \\lab.local\Shares\NYC_Data
3. Control Panel Restriction: Navigate to:

   User Configuration > Policies > Administrative Templates > Control Panel

   • Set Prohibit access to Control Panel and PC settings to Enabled (or Enabled with specific access if testing standard user lockdowns)

Step 4: Verify Inheritance & Apply to Client

GPOs process from Top-Down (Site → Domain → Parent OU → Child OU). Linking at Workstations > NYC ensures only workstations in that container receive these rules.

Test Policy Application on Client

1. Log onto WIN11-VM as a user in the NYC user OU.
2. Open Command Prompt and run:

   gpupdate /force
   gpresult /r

3. Review the output:
   • Under Computer Settings: GPO_NYC_Workstations_Baseline should show as Applied
   • Under User Settings: GPO_NYC_User_Preferences should show as Applied

Troubleshooting: Drive Mapping Not Loading

After running gpupdate /force, the mapped drive may not appear. Here's the common fix:

Root Cause: Shared Folder Doesn't Exist

The GPO references a share path that hasn't been created yet on the Domain Controller.

Solution: Create the Shared Folder

1. On DC01, create the folder: C:\Shares\NYC_Data
2. Right-click the folder → Properties → Sharing tab.
3. Click Share... and add Domain Users with at least Read permissions.

Update the GPO

Once the share exists, update the GPO to point to the correct path:

Re-test on Client

1. Run gpupdate /force again on the client.
2. Open File Explorer.
3. The NYC_Data (S:) drive should now appear.

Key Takeaways

• GPO Inheritance: Policies flow down the OU hierarchy. Child OUs inherit parent policies unless explicitly blocked.
• GPUPDATE: Always run gpupdate /force after modifying GPOs on the client to immediately refresh policy application.
• GPRESULT: Use gpresult /r to verify which GPOs are actually applied to a specific user/computer.
• Shared Resources: Ensure network shares, UNC paths, and permissions exist before referencing them in GPOs.
• Testing: Test GPOs on client machines before applying domain-wide to catch configuration issues early.