Group Policy

What is Group Policy?

Group Policy is the mechanism in Windows and Active Directory that lets administrators define settings and security rules centrally in Group Policy Objects (GPOs) and enforce them automatically on every computer and user in a domain. A single change on a domain controller reaches hundreds of workstations and servers within a few hours, without anyone touching each machine. In OT environments, Group Policy is the main tool for keeping engineering stations, HMI clients, historians and SCADA servers consistent and hardened.

🧠 How does Group Policy work?

Group Policy has existed since Windows 2000 and runs on every Windows machine that is a member of a domain. A GPO consists of two parts: an object in Active Directory (the Group Policy Container) holding version and link information, and a folder in the shared SYSVOL directory on the domain controllers (the Group Policy Template) holding the actual settings, scripts and templates.

The process runs in four steps:

1. Create - an administrator creates a GPO in the Group Policy Management Console (GPMC) and fills in computer and/or user settings.
2. Link - the GPO is linked to a site, the domain or an OU (Organizational Unit). Only computers and users in that container (and its child OUs) fall under it.
3. Retrieve - the Group Policy Client on the machine queries via LDAP which GPOs apply and fetches the files from SYSVOL over SMB. Kerberos handles authentication to the domain controller.
4. Apply - client-side extensions (CSEs) each process their part: registry settings, security settings, scripts, software installation, firewall rules and more.

Computer policy is applied at startup, user policy at sign-in. Windows then refreshes policy in the background, by default every 90 minutes plus a random delay of up to 30 minutes; domain controllers check every 5 minutes. Running gpupdate /force triggers an immediate refresh.

🔄 In what order are GPOs applied?

When several GPOs touch the same setting, the processing order decides which one wins. In practice this order is known as LSDOU:

Policy applied later overrides policy applied earlier, so the OU closest to the object wins. Two mechanisms break that rule:

• Enforced - a property of a GPO link: lower levels cannot override these settings. Useful for a mandatory security baseline.
• Block Inheritance - a property of an OU: policy from higher levels is not inherited, unless that policy is Enforced.

You can narrow the scope further with security filtering (only certain groups or computers) and WMI filters (for example only on Windows Server 2022). For kiosk and operator stations, loopback processing is useful: the computer’s user policy applies regardless of who signs in.

🔧 Which settings can you manage with Group Policy?

A current Windows release has thousands of Group Policy settings, defined in ADMX templates. The most important categories for security are:

• Account and password policy - length, complexity and lockout. For domain accounts, only the password policy from a GPO linked at domain level applies (exceptions per group use fine-grained password policies).
• User Rights Assignment - who may sign in locally or via RDP, who may run as a service; the basis of least privilege and RBAC.
• Audit policy - which events Windows records, as input for logging and SIEM.
• Windows Defender Firewall - inbound and outbound rules per profile.
• Device and application control - blocking USB storage (USB Control) and application whitelisting with AppLocker or App Control for Business.
• Windows Update - routing updates through your own WSUS server and preventing automatic restarts, so that patch management stays under control.
• Group Policy Preferences - since Windows Server 2008: drive mappings, scheduled tasks, local groups and registry keys.
• Windows LAPS - built into Windows since the update of 11 April 2023: rotates the local administrator password per machine and stores it in Active Directory.

🏭 How do you use Group Policy in OT networks?

In industrial environments, many Windows systems run at Purdue levels 2 and 3. Group Policy keeps them consistent:

• Engineering stations - fixed settings, encryption, no local admin rights for day-to-day users.
• HMIs and operator stations - a locked-down desktop via loopback, automatic sign-in with a restricted account, no access to settings, the command prompt or PowerShell.
• Logging - forwarding Windows events to a central collector or a Syslog or SIEM platform.
• Firewall baseline - local firewall rules that allow only the required protocols, as an extra layer next to network segmentation.

A common architecture is a separate OT domain with its own domain controllers inside the OT zone, independent of the corporate AD. A compromised IT domain then cannot push policy to the plant floor. Administrator access runs through a jump server in the IDMZ.

Watch out for vendor dependencies: not every setting from a standard baseline is approved for a given DCS or SCADA package. A well-known example is Microsoft’s DCOM hardening (CVE-2021-26414), which became permanently enforced on 14 March 2023 and broke OPC Classic connections on poorly prepared installations.

🧭 How do you set up Group Policy for OT step by step?

1. Inventory all Windows systems, their role and the configuration approved by the vendor.
2. Design an OU structure per role (engineering, HMI, servers) and optionally per production line, so you can link policy precisely.
3. Start from a baseline such as the Microsoft security baselines or the CIS Benchmarks, and document deviations the vendor requires.
4. Test every new GPO on a representative test system or test OU first; compare GPO sets with Policy Analyzer from the Microsoft Security Compliance Toolkit.
5. Roll out in a controlled way through change management, preferably in a maintenance window, and verify with gpresult /h report.html.
6. Monitor changes by sending audit events on GPO modifications to the SIEM and keeping GPO backups.

Standalone machines outside the domain, such as an isolated HMI, receive the same baseline with the LGPO.exe tool, which imports and exports local policy.

🔐 What security risks does Group Policy carry?

Whoever controls Group Policy controls every machine in the domain. That also makes the mechanism attractive to attackers:

Attackers who live off the land deliberately use legitimate admin tools such as Group Policy, because they attract less attention than malware.

🔍 What is the difference between Group Policy and MDM?

For OT, Group Policy therefore remains the norm for now, while office workstations increasingly move to MDM.

📜 How does Group Policy support compliance?

Well-managed GPOs provide demonstrable evidence for compliance. In IEC 62443 they map onto requirements for identification and authentication, use control and audit logging; in ISO 27001 onto controls for configuration management and access control. Under NIS2 and the Dutch Cybersecurity Act, essential and important entities must take appropriate measures for access control and basic cyber hygiene, among other things; a documented GPO baseline with gpresult reports and an audit trail is concrete evidence for that.

❓ Frequently asked questions

What is a GPO?

A GPO (Group Policy Object) is a collection of Windows settings stored as a single object in Active Directory and linked to a site, domain or OU. Every computer or user within that container automatically applies the settings from the GPO.

How often is Group Policy refreshed?

Group Policy is applied at startup and sign-in and is then refreshed by default every 90 minutes, with a random delay of up to 30 minutes. Domain controllers refresh their computer policy every 5 minutes, and gpupdate /force reapplies everything immediately.

Does Group Policy work without Active Directory?

Without Active Directory, each Windows machine only has its own local group policy, editable with gpedit.msc. With Microsoft’s LGPO.exe tool you can still apply a baseline consistently to standalone OT systems outside a domain.

How do you check which GPOs are active on a machine?

Running gpresult /r shows which GPOs were applied to or filtered out on a machine, and gpresult /h report.html produces a full HTML report. In the Group Policy Management Console, Group Policy Results shows the same information remotely.

Should an OT network have its own Active Directory domain?

A separate OT domain with its own domain controllers is a common recommendation, because an attacker with admin rights in the IT domain then cannot push Group Policy to OT systems. It does require separate management, patching and backups of those domain controllers.

Does Intune replace Group Policy?

Intune replaces Group Policy for cloud-managed workstations, but not for OT systems without an internet connection. In industrial networks, on-premises Group Policy therefore remains the standard tool for Windows hardening.

📌 In summary

Group Policy is the central mechanism for enforcing Windows settings across a domain through GPOs, and with that the backbone of Windows hardening in both IT and OT. With a well-designed OU structure, a tested baseline, a separate OT domain and strict control over who may change GPOs, you increase the resilience of OT systems against errors and attacks.