MigrationBot: Backfill (v3.0 review queue): added to the review queue

2026-09-22T05:42:50Z

Backfill (v3.0 review queue): added to the review queue

← Older revision		Revision as of 05:42, 22 September 2026
Line 88:		Line 88:
	[[Category:Windows Group Policy\|006]]		[[Category:Windows Group Policy\|006]]
	[[Category:Migrated from cypat.guide]]		[[Category:Migrated from cypat.guide]]
			[[Category:Pending review]]

MigrationBot: Import from cypat.guide: docs/windows/group_policy/intro_group_policy.md

2026-09-18T17:06:33Z

Import from cypat.guide: docs/windows/group_policy/intro_group_policy.md

New page

{{Submit}}

-----

Author(s): a_person

Last Updated: 07-03-2025

{| class="mw-collapsible mw-collapsed wikitable" style="width:100%"
! Recommended Prerequisites (click to expand)
|-
|

None

|}

== What is it? ==

Group Policy is a feature in Microsoft Windows that allows administrators to manage settings for users and computers. It provides centralized configuration and enforcement of operating systems, applications, and user settings. It's used in either networks or locally.

== Concepts ==

* '''Where Group Policy settings are stored:'''
** '''Registry Keys:''' The actual policy settings are written to these protected registry locations, overriding standard user or application settings.
*** <code>HKEY_LOCAL_MACHINE\Software\Policies</code> (for computer settings)
*** <code>HKEY_CURRENT_USER\Software\Policies</code> (for user settings)
*** ''(And the corresponding ...\Microsoft\Windows\CurrentVersion\Policies locations)''
** '''File System:''' The <code>%SystemRoot%\System32\GroupPolicy\</code> directory stores the files that make up a GPO, including administrative templates and script files.

== Group Policy vs Registry ==

They are both used to configure settings, but Registry is basically an unc. Here are the main differences:

* Each registry is local to its respective machine, while Group Policies can be applied to multiple computers
* Group policy is more persistent as group policies apply during startup.
* Group Policy is much easier to use as it gives setting names and explanations.

== How do I change Group Policies ==

* <code>gpedit.msc</code>
** Locally. You can edit them just by selecting the policies you want to set.
* <code>gpmc.msc</code> - For groups.
** For groups. You can edit them by selecting them on the sidebar.

== Local Security Policy ==

<code>secpol.msc</code> is a specific section of the local group policy(<code>Computer Configuration > Windows Settings > Security Settings</code>). Any change you make in <code>secpol.msc</code> is actually being made within the Local Group Policy (<code>gpedit.msc</code>) and can be viewed there.

'''Main Settings Configured in <code>secpol.msc</code>:'''

* '''Account Policies''' - This is where you configure password requirements (length, complexity, history) and account lockout policies (e.g., lock an account after 5 bad password attempts).
* '''Audit Policy''' - Determines which security-related events are logged in the Windows Security Event Log. For example, you can audit successful or failed logon attempts.
* '''User Rights Assignment''' - Controls the specific rights and privileges that users and groups have on the local machine, such as "Shut down the system" or "Back up files and directories."
* '''Security Options''' - A large collection of miscellaneous security settings, such as "Interactive logon: Do not display last user name" or policies related to User Account Control (UAC).

== Tools for automation and compliance ==

* [https://www.microsoft.com/en-us/download/details.aspx?id=55319 LGPO] - Allows you to import and export GPOs
* [https://github.com/scipag/HardeningKitty Hardening Kitty] - Similar to lgpo, and has diverse modes which can allow you to see the most critical policies that are set incorrectly. It also contains some premade baselines.
* [https://public.cyber.mil/stigs/scap/ SCC] - Developed by the Department of Defense. SCC has Security Content Automation Protocol (SCAP) content and tools to help with security compliance and automation.

== Premade baselines ==

* [https://www.cisecurity.org/cis-benchmarks CIS Benchmarks] - Baselines made by the Center for Internet Security. It provides two levels of baselining and is widely used.
* [https://stigviewer.com/stigs DoD Stigs] - Security baselines created by the Department of Defense. These guides are used to harden military networks and systems.

== Practice ==

ALL images except for images like the persistence image contain Group Policy points:<br />
images.cypat.guide

-----

=== References, Further Reading, & Tools Mentioned ===

* https://en.wikipedia.org/wiki/Group_Policy
* https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/group-policy/group-policy-overview
* https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/group-policy/group-policy-management-console
* https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn265982(v=ws.11)
* https://www.microsoft.com/en-us/download/details.aspx?id=55319
* https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/how-to-configure-security-policy-settings
* https://github.com/scipag/HardeningKitty
* https://public.cyber.mil/stigs/scap/
* https://www.cisecurity.org/cis-benchmarks
* https://stigviewer.com/stigs

[[Category:Windows Group Policy|006]]
[[Category:Migrated from cypat.guide]]

Draft:Introduction to Group Policy - Revision history

MigrationBot: Backfill (v3.0 review queue): added to the review queue

MigrationBot: Import from cypat.guide: docs/windows/group_policy/intro_group_policy.md