Bundles Group Policy settings together. Held in Active Directory, it's linked to an OU, domain or site so that the computers and people within are configured by it.
Also called Group Policy Object.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains GPO in context, with comparison tables and the common traps.
Terms in this definition
- Exclusions
Scopes taken out of a policy assignment; they can only narrow its coverage, never widen it.
- AD
Short for Active Directory, the directory service built into Windows Server (AD DS). Entra Connect synchronises on-premises forests to Microsoft Entra ID.
- Domain
A way of grouping workspaces by area of the business, in support of a data mesh approach. Items take on their workspace's domain, letting you filter the OneLake catalog by it, and certain tenant settings can be passed to domain admins; domains have no effect on access permissions.
- LSDOU
The sequence in which Group Policy is processed: the local policy first, followed by site, domain and organisational unit policies. The nearest, last-processed setting takes effect unless Enforced or Block Inheritance alters that.
Related terms
- AADDC Computers
Container built into an Entra Domain Services managed domain, holding joined VMs' computer accounts, with a GPO of its own.
- AADDC Users
Container built into an Entra Domain Services managed domain, holding groups and users synchronised there, with a GPO of its own.
- Default Domain Policy
Linked at the domain's root, this GPO holds lockout, password and other account settings for the whole domain; dcgpofix can rebuild it.
- Security Compliance Toolkit
Microsoft's no-cost successor to Security Compliance Manager, providing security baselines packaged as GPO backups plus utilities such as LGPO and Policy Analyzer for comparing and applying them.
- Security filtering
Narrows which computers, users or groups a GPO affects. By default Authenticated Users holds the Read and Apply group policy permissions; granting them only to chosen principals restricts the GPO.
- WMI filter
Attached to a GPO, this WQL query means the policy only applies to computers where it evaluates to true, such as those running a certain OS version.