4.1 Group Policy Architecture & Processing Order (LSDOU)

Group Policy Fundamentals, Architecture & Processing Order

In enterprise hybrid and on-premises environments, Group Policy remains the foundational framework for centralizing configuration management, security baselines, and operating system governance across Active Directory Domain Services (AD DS). Group Policy allows administrators to define desired-state configurations for operating systems, application behavior, user desktop environments, and security boundaries across thousands of domain-joined endpoints.

Mastering the internal storage architecture of Group Policy Objects, the strict execution order of policy processing, inheritance override mechanisms, security filtering nuances, and diagnostic toolsets is mandatory for passing the AZ-800 exam and managing enterprise Windows Server infrastructures.

---

1. Group Policy Object Architecture: GPC vs. GPT

A Group Policy Object (GPO) is not a single monolithic file. Instead, every GPO is physically split into two logically linked, independently replicated components: the Group Policy Container (GPC) stored in Active Directory and the Group Policy Template (GPT) stored in the file system within the SYSVOL shared folder.

+-----------------------------------------------------------------------------------+
|                     DUAL-COMPONENT GROUP POLICY ARCHITECTURE                      |
|                                                                                   |
|  [ACTIVE DIRECTORY DATABASE: NTDS.DIT]           [SYSVOL REPLICATED FOLDER SHARE] |
|                                                                                   |
|  Group Policy Container (GPC)                     Group Policy Template (GPT)     |
|  LDAP: CN={GUID},CN=Policies,CN=System,DC=...    Path: \\<Domain>\SYSVOL\<Domain>\|
|                                                        Policies\{GUID}            |
|  Attributes:                                      Directory Structure:            |
|  - versionNumber (32-bit integer)                 - gpt.ini (Version=<Int>)       |
|  - gPCFileSysPath (UNC to SYSVOL)                 - \Machine\                     |
|  - gPCMachineExtensionNames (CSE GUIDs)             - Registry.pol, Scripts/      |
|  - gPCUserExtensionNames (CSE GUIDs)              - \User\                        |
|  - flags (0=Enabled, 1=UserDis, 2=CompDis)          - Registry.pol, Scripts/      |
|                                                                                   |
|  Replication Engine:                              Replication Engine:             |
|  - AD DS Directory Replication (RPC / DRA)        - DFS Replication (DFSR)        |
+-----------------------------------------------------------------------------------+

The Group Policy Container (GPC):

• Storage Location: Stored in the Active Directory domain directory partition under CN=Policies,CN=System,DC=corp,DC=contoso,DC=com.
• Function: Stores GPO metadata, status flags, link information, and the list of registered Client-Side Extension (CSE) GUIDs required to interpret the policy settings.
• Version Number Tracking: Maintains a 32-bit integer attribute (versionNumber). The high 16 bits represent the version of the User Configuration, while the low 16 bits represent the version of the Computer Configuration.
• Replication: Synchronized between domain controllers via standard Active Directory Directory Replication Service (DRS) using RPC over TCP.

The Group Policy Template (GPT):

• Storage Location: Stored in the file system under \\<Domain>\SYSVOL\<Domain>\Policies\{GPO-GUID}\.
• Function: Contains the actual configuration data files, scripts, Administrative Template registry settings (Registry.pol), folder redirection rules, and preference XML files.
• Core Files and Folders:
  • gpt.ini: Contains a single [General] section with a Version=<Integer> key that must match the GPC versionNumber.
  • \Machine\: Contains computer-specific settings, startup/shutdown scripts, and machine Registry.pol.
  • \User\: Contains user-specific settings, logon/logoff scripts, and user Registry.pol.
• Replication: Synchronized across domain controllers using Distributed File System Replication (DFSR) (or legacy FRS on deprecated domain functional levels).

[!IMPORTANT] Version Mismatch & Replication Latency: When an administrator edits a GPO, both the GPC in AD DS and the GPT in SYSVOL have their version numbers incremented simultaneously. If Active Directory replication completes before DFSR synchronizes the file system changes (or vice versa), a temporary version mismatch occurs. The Group Policy client engine compares the GPC version with the GPT version; while they disagree the client can process a stale copy of the GPO until SYSVOL converges. Each GPO's version is visible in the GPO discovery events (5312 applied, 5313 filtered out) and in gpresult /r, so a version that lags the GPMC's is the signal to check DFSR health rather than the GPO's settings.

---

2. GPO Processing Order (LSDOU) & Precedence Rules

When a domain-joined computer boots or a user signs in, the Group Policy engine processes linked GPOs in a rigid, hierarchical sequence known by the acronym LSDOU:

1. Local (L): The local Group Policy stored on the individual client machine (gpedit.msc). Includes Local Group Policy, Administrator/Non-Administrator local policies, and User-Specific local policies.
2. Site (S): GPOs linked to the Active Directory Site object corresponding to the client's current IP subnet.
3. Domain (D): GPOs linked directly to the root of the Active Directory domain container (e.g., Default Domain Policy).
4. Organizational Unit (OU): GPOs linked to Organizational Units, processed sequentially from the highest ancestor Parent OU down through nested Child OUs to the specific OU containing the target computer or user account.

+-----------------------------------------------------------------------------------+
|                         LSDOU PROCESSING PRECEDENCE PIPELINE                      |
|                                                                                   |
|  [1. LOCAL GPO]       --> Evaluated 1st (Lowest Precedence)                       |
|          |                                                                        |
|          v                                                                        |
|  [2. SITE GPO]        --> Evaluated 2nd (Overwrites conflicting Local settings)   |
|          |                                                                        |
|          v                                                                        |
|  [3. DOMAIN GPO]      --> Evaluated 3rd (Overwrites conflicting Site settings)    |
|          |                                                                        |
|          v                                                                        |
|  [4. PARENT OU GPO]   --> Evaluated 4th (Overwrites conflicting Domain settings)  |
|          |                                                                        |
|          v                                                                        |
|  [5. CHILD OU GPO]    --> Evaluated LAST (HIGHEST PRECEDENCE by default)          |
|                                                                                   |
|  GOLDEN RULE: The setting processed LAST in time WINS in event of conflict.       |
+-----------------------------------------------------------------------------------+

Link Order Within the Same Container:

When multiple GPOs are linked to the same Active Directory container (e.g., three separate GPOs linked to the Finance OU), policies are processed in reverse numeric order:

• Link Order N (e.g., Link 3): Processed first.
• Link Order 1: Processed last. Therefore, Link Order 1 has the highest precedence among GPOs linked to that specific container and overwrites conflicting settings from Link 2 and Link 3.

Inheritance Controls: Block Inheritance vs. Enforced

Two administrative mechanisms alter the standard LSDOU processing hierarchy:

1. Block Inheritance (Block Policy Inheritance):
   • Configured at the OU or Domain level.
   • Prevents GPOs linked to higher-level ancestor containers (Parent OUs, Domain, or Sites) from being inherited by objects within that OU.
   • Does not block GPOs linked directly to the OU itself.
2. Enforced (Enforce / Formerly "No Override"):
   • Configured on an individual GPO link.
   • Has two critical operational effects:
     • Bypasses Block Inheritance: An Enforced GPO linked at the Domain or Parent OU level will be processed by child OUs even if those OUs have enabled Block Inheritance.
     • Forces Highest Precedence: The Enforced GPO is moved to the very end of the processing pipeline, meaning its settings overwrite conflicting settings defined in lower-level Child OUs.
   • Multiple Enforced GPOs: If two GPOs are marked Enforced and contain conflicting settings, the Enforced GPO linked highest in the AD DS hierarchy (Site > Domain > Parent OU) takes final precedence.

Group Policy Precedence & Override Resolution Matrix