Okay.
Let's summarize what we learned in this module.
Client side extensions or CCS are the agents of group policy.
So the group policy engine calls the client side extensions to do the work of processing GPOs and their
settings.
Each policy area typically has its own CAC, which is implemented as a DLR.
Microsoft provides a bunch of these in the box for all the various policy areas admin templates, security
preferences, all those different policy areas.
Microsoft provides the CAC deal for third parties can also extend group policy capability by writing
their own, and it snaps right into that engine and gets called just like the Microsoft ones do.
User and computer objects and aid are the things that actually process policy.
Key fundamental point about GPO.
It's the user and computer object, not groups, not anything else in ADD that are the things that are
doing the work of processing policy.
The things that are being targeted.
And that's how you need to think about group policy in general and GPO targeting in particular.
So if you're in the GP, Ed, you look under computer configuration, everything you see under there
is only going to be processed by computers.
If you're in the user configuration section, everything you see in there is only processed by users.
GPOs can be targeted using linking.
Linking is the fundamental way of applying GPOs to users and computers.
You can link at the site level, the domain level or at the EU level.
So essentially you had those three options for how you target a particular GPO to a set of computers
and users.
Further.
Once you've linked to GPO, you can exclude certain populations or include certain populations based
on filtering.
You can use security groups.
You can use WMI filters.
Those first two are at the whole GPO level.
So if I'm in a group, I get the GPO.
If I'm not in the group, I don't get it.
Same with filtering of WMI filters.
GP preferences is evaluated after the GPO has determined passed fail from those other methods.
And preferences are evaluated on the per preference setting level based on whatever item level targeting
you've defined.
GPOs are processed using an order precedence that's local GPO first, then any site linked GPOs.
Any domain linked GPOs and finally any EU linked GPOs.
So when the user computer fires up their processing cycle, they look at the list of GPOs that applied
based on linking and filtering and then apply those in this LSW order.
And as I showed, you can have multiple GPOs at a given container level site domain or you.
And you can also control the order of precedence on that.
So number one, meaning the highest priority.
That essentially means the GPO is processed last for that container.
And therefore can overwrite any settings that conflict with it that are processed previously.
And to that point, last writer wins in the event of settings conflicts.
So what that means is under normal circumstances, if you've got conflicting settings at the domain
and EU level, because the EU is typically closer to where the user computer resides.
Those settings that are linked to the oh, you are going to win because they are processed last.
So hopefully that gives you a good sense of how GPO is processed and targeted.
And in the next section, we're going to talk about the tools that you can use to manage group policy.