1.
What is "gpresult," and how do you use it to check
GPO results?
2. Can you explain the precedence of GPOs in Active
Directory?
3. How do you remove a GPO that is no longer
required?
4. What would you do if a GPO is not applying as
expected?
Tip: Practicing these GPOs in a test Active Directory
environment will help you gain hands-on experience and
confidently discuss them in your interview. Let me know
if you need help with specific examples or a detailed
explanation for any GPO setup!
You said:
Common GPOs for L2 Desktop Support: now can you
give full practical how do i set this in coincise and crisp
manner
ChatGPT said:
Here’s a concise, step-by-step guide to setting the
common GPOs practically. These steps assume you have
access to the Group Policy Management Console (GPMC)
in a Windows Active Directory environment.
1. Password Policy
Objective: Enforce password length, complexity, and
expiration.
1. Open Group Policy Management Console (GPMC) →
Edit the Default Domain Policy.
2. Navigate to:
Computer Configuration → Policies → Windows
Settings → Security Settings → Account Policies →
Password Policy.
3. Configure:
o Minimum password length: Set to desired
value.
o Password complexity: Enable.
o Maximum password age: Set expiration in
days.
4. Save and close.
2. Account Lockout Policy
Objective: Lock accounts after multiple failed login
attempts.
1. In the GPMC, go to:
Computer Configuration → Policies → Windows
Settings → Security Settings → Account Policies →
Account Lockout Policy.
2. Configure:
o Account lockout threshold: Set (e.g., 5
attempts).
o Lockout duration: Set (e.g., 30 minutes).
o Reset counter: Set (e.g., 30 minutes).
3. Save and apply.
3. Desktop Wallpaper Policy
Objective: Set corporate wallpapers.
1. Go to:
User Configuration → Policies → Administrative
Templates → Desktop → Desktop.
2. Enable Desktop Wallpaper → Enter the path to the
image (e.g., \\Server\Share\[Link]).
3. Set wallpaper style (e.g., Fill, Center).
4. Save and apply.
4. Drive Mapping
Objective: Automatically map network drives for users.
1. Go to:
User Configuration → Preferences → Windows
Settings → Drive Maps.
2. Right-click → New → Mapped Drive.
3. Configure:
o Location: Enter network path (e.g., \\Server\
Share).
o Drive letter: Assign (e.g., Z:).
4. Save and close.
5. Folder Redirection
Objective: Redirect folders like Documents to a network
path.
1. Go to:
User Configuration → Policies → Windows Settings →
Folder Redirection.
2. Right-click on the folder (e.g., Documents) →
Properties.
3. Select Basic → Enter network path (e.g., \\Server\
Redirect\%username%).
4. Save and apply.
6. Blocking USB Devices
Objective: Disable USB storage access.
1. Go to:
Computer Configuration → Policies → Administrative
Templates → System → Removable Storage Access.
2. Configure settings:
o Deny write access to removable drives: Enable.
o Deny read access to removable drives: Enable.
3. Save and close.
7. Firewall Rules Management
Objective: Enforce inbound and outbound rules.
1. Go to:
Computer Configuration → Policies → Windows
Settings → Security Settings → Windows Firewall
with Advanced Security.
2. Configure Inbound/Outbound Rules:
o Right-click → New Rule → Choose Port/Program.
o Define the port, protocol, or program path.
o Allow or Block the connection.
3. Save and apply.
8. Automatic Windows Updates
Objective: Automate update schedules.
1. Go to:
Computer Configuration → Policies → Administrative
Templates → Windows Components → Windows
Update.
2. Configure:
o Configure Automatic Updates: Enable and
choose the schedule.
o Set update notification or download options.
3. Save and apply.
9. Restricting Control Panel Access
Objective: Prevent users from accessing the Control
Panel.
1. Go to:
User Configuration → Policies → Administrative
Templates → Control Panel.
2. Configure:
o Prohibit access to Control Panel: Enable.
3. Save and apply.
10. Screen Lock Policy
Objective: Automatically lock screens after inactivity.
1. Go to:
User Configuration → Policies → Administrative
Templates → Control Panel → Personalization.
2. Configure:
o Password protect the screensaver: Enable.
o Screensaver timeout: Set (e.g., 900 seconds =
15 minutes).
3. Save and apply.
General Steps for Applying GPOs:
1. After configuring the GPO, link it to the appropriate
OU (Organizational Unit) in GPMC.
2. Run the command gpupdate /force on client
machines to apply changes immediately.
3. Verify using gpresult /h [Link] or the Event
Viewer.
Let me know if you want detailed steps for any specific
GPO or additional troubleshooting tips!