It's important to understand how group policies apply on client computers.
The steps are as follows First when a group policy refresh begins a service that is run on all on all
windows based computers known as Group Policy client service in Windows Vista and later and Windows
2000 eight and later.
So this service determines which GPO is applied to the computer or user.
Second the group policy client service downloads and a GP those that are not cached already.
Third group policy.
Client site extensions interpret the sentence in GPO and make appropriate changes to the local computer
or to the currently signed end user.
There are client side extensions for each major category of policies set in.
For example there is a security line site extension that applies security changes airline side extensions
that exact start up and log on scripts as C as e that installs software and the client side extension
that makes changes to registry keys and values.
Each Windows operating system version has added client side extensions to extend the functional reach
of group policy and there are several dozen client sites extensions in Windows operating systems.
One of the more important concepts to remember about group policy is that it is a client driven group
policy client service pools GPO was from the domain triggering the client side extensions to license
locally group policy is not a push technology.
You can see the installed client side extensions on a computer by allocating the appropriate register
key.
It is located in each key local machine.
Microsoft Windows and teh current version of Vin Logan GP extension extensions.
You can configure the behaviour of client side extensions by use and group politics.
Most client side extensions supplied settings in a GPO only if the GPO has changed.
This behaviour improves overall policy process and by eliminating redundant applications of the same
settings most policies apply in such a way that standard users cannot change the setting on their computer.
They always will be subject to the configuration enforced by group policy.
However standard users can change some settings and a user can change many settings if that user is
an administrator of the system.
If users in your environment are administrators on their computers you should consider configure and
client site extensions to reapply policy settings.
Even if the GPO has not changed that way if an administrative user changes the configuration so that
it is no longer compliant with policy the configuration will be reset to its compliance state as the
next group policy refresh to configure such client site extensions to reply policy settings.
You can do that by configuring a GPO scoped to computers and then defining the settings in the computer
configuration policies administrative templates system group policy node for each client site extension
that you want to configure open its policy process and policies set and such as registry policy process
and for the registry CSC click enabled and then select the process.
Even if the group policy objects have not changed checkbox now the security line site extension manages
an important exception to the default policy process and certainly the security line site extension
reapply security settings every 16 hours.
Even if a GPO hasn't changed as a note here enable that all this wait for network at startup and log
on policies set in for all vendors based clients.
Without this set and by default Windows XP and later clients will form refreshes asynchronously the
user resides in a use and cached credentials.
The benefit is that the desktop is quicker to display and user can start to work without waiting for
group policy to apply.
This means that when the client computer starts up and the user assigns them they do not receive the
latest policies from the domain group policy will perform a refresh in the background after the user
assigns them so they said and is located in computer configuration policies administrative templates
system log on.
Be sure to read the policy settings explanatory attacks the setting changes the group policy process
and to synchronous mode which might make process and slower but it ensures a more consistent environment.
Some words about policy refresh policies settings and computer configuration note apply it system start
up and then every 90 to 120 minutes thereafter policies set in the user configuration node.
Apply it sign in and then every 90 to 120 minutes thereafter the application of policies is called Group
Policy refresh the refresh that years at system startup and to user sign in is also referred to as foreground
to refresh the periodic refresh that occurs every 90 to 120 minutes and manual refreshes are both referred
to as background refreshes.
Some client side extensions only apply settings during foreground process and of course you can always
force a policy refresh by using the GP update command.