Skip to content

GPO Template

Objective

Provide the approved starter template for the first Group Policy Objects in the deployment standard, including:

  • exact names
  • target scope
  • initial implemented settings
  • validation points
  • planned future hardening

Use this page as the reusable design template for day-zero baseline GPOs. The lab-validated implementation currently comes from P03-T03.

Approved Starter GPO Inventory

GPO Type Linked to Status
Default Domain Policy Default AD policy Domain root Preserved
Default Domain Controllers Policy Default AD policy OU=Domain Controllers Preserved
GPO-DC-Baseline Custom baseline OU=Domain Controllers,DC=corp,DC=gntech,DC=me Implemented
GPO-Servers-Baseline Custom baseline OU=Servers,OU=GNTECH,DC=corp,DC=gntech,DC=me Implemented
GPO-Workstations-Baseline Custom baseline OU=Workstations,OU=GNTECH,DC=corp,DC=gntech,DC=me Implemented
GPO-Users-Baseline Custom baseline OU=Users,OU=GNTECH,DC=corp,DC=gntech,DC=me Implemented

Default Domain Policy

The following domain-wide password and lockout settings were configured centrally through Set-ADDefaultDomainPasswordPolicy:

Setting Value
Complexity Enabled
Minimum password length 14
Password history 24
Minimum password age 1 day
Maximum password age 90 days
Lockout threshold 10
Lockout duration 15 minutes
Lockout observation window 15 minutes

These settings are domain policy, not separate per-OU GPO settings.

Lab-validated current state

Validated against the live lab as of Friday, July 17, 2026:

  • GPO-DC-Baseline, GPO-Servers-Baseline, and GPO-Workstations-Baseline are created by scripts/Configure-HQ-DC01-GPOBaseline.ps1.
  • GPO-Users-Baseline is created by scripts/Configure-HQ-DC01-UserGPOBaseline.ps1.
  • the current validated OU targets are direct children of OU=GNTECH
  • not an intermediate OU=Computers
  • workstation validation proved the baseline is actually reaching joined Windows clients
  • user validation proved the user baseline is actually reaching a real user session

GPO-DC-Baseline

Scope

  • Linked to OU=Domain Controllers,DC=corp,DC=gntech,DC=me
  • Intended for HQ-DC01 and future domain controllers only

Implemented settings

Category Setting Value
Event Log Application log max size 131072 KB
Event Log Security log max size 262144 KB
Event Log System log max size 131072 KB
PowerShell Script Block Logging Enabled

Validation

  • Get-GPO -Name 'GPO-DC-Baseline'
  • Get-GPInheritance -Target 'OU=Domain Controllers,DC=corp,DC=gntech,DC=me'
  • gpresult /scope computer /r on a domain controller

GPO-Servers-Baseline

Scope

  • Linked to OU=Servers,OU=GNTECH,DC=corp,DC=gntech,DC=me
  • Intended for domain-joined member servers such as HQ-FS01

Implemented settings

Category Setting Value
Event Log Application log max size 131072 KB
Event Log Security log max size 262144 KB
Event Log System log max size 131072 KB
PowerShell Script Block Logging Enabled

Validation

  • Get-GPO -Name 'GPO-Servers-Baseline'
  • Get-GPInheritance -Target 'OU=Servers,OU=GNTECH,DC=corp,DC=gntech,DC=me'
  • gpresult /scope computer /r on a member server

GPO-Workstations-Baseline

Scope

  • Linked to OU=Workstations,OU=GNTECH,DC=corp,DC=gntech,DC=me
  • Intended for Windows 11 corporate clients

Implemented settings

Category Setting Value
Event Log Application log max size 65536 KB
Event Log Security log max size 131072 KB
Event Log System log max size 65536 KB
PowerShell Script Block Logging Enabled

Validation

  • Get-GPO -Name 'GPO-Workstations-Baseline'
  • Get-GPInheritance -Target 'OU=Workstations,OU=GNTECH,DC=corp,DC=gntech,DC=me'
  • gpresult /scope computer /r on a domain-joined workstation

GPO-Users-Baseline

Scope

  • Linked to OU=Users,OU=GNTECH,DC=corp,DC=gntech,DC=me
  • Intended for standard user accounts

Implemented settings

Category Setting Value
Explorer Show file extensions Enabled
Taskbar Hide feeds/news widget style experience Enabled
User restrictions Block Control Panel and Settings Enabled

Validation

  • Get-GPO -Name 'GPO-Users-Baseline'
  • Get-GPInheritance -Target 'OU=Users,OU=GNTECH,DC=corp,DC=gntech,DC=me'
  • gpresult /h C:\Temp\gpresult-user.html from a real user session in the target OU

Baseline assessment

The current starter baseline is intentionally small, and that is the correct design choice.

What should stay in the baseline:

  • default domain password and lockout policy
  • event log sizing
  • PowerShell Script Block Logging

What should not be forced into the baseline yet:

  • LAPS
  • advanced auditing
  • Defender hardening
  • ASR
  • Windows firewall profile policy
  • browser controls
  • BitLocker
  • local admin membership control

Reason:

  • these controls are useful, but they are harder to validate safely
  • they belong in later hardening layers
  • keeping baseline separate from hardening makes rollback cleaner
  • Keep the current four baseline GPOs.
  • Keep password policy outside OU-linked GPOs and manage it centrally through Set-ADDefaultDomainPasswordPolicy.
  • Keep all current OU path references aligned with the lab-validated direct-child layout under OU=GNTECH.
  • Treat this page as the template and consultation point, while P03-T03 remains the implementation runbook.

What Is Intentionally Not Yet in GPO

The current baseline is intentionally minimal. The following items are not yet implemented in the validated baseline:

  • LAPS
  • Advanced audit policy
  • advanced Microsoft Defender hardening beyond the validated basic posture
  • ASR rules
  • Firewall profile hardening through GPO
  • SMB signing policy
  • NTLM reduction policy
  • RDP restrictions
  • Local administrator group governance
  • Windows Update ring strategy
  • BitLocker policy
  • Browser or Edge enterprise controls

These should be introduced in a later hardening phase after each control is validated in the lab.

Validated workstation hardening layer

GPO-Workstations-Hardening is now implemented separately from the first three baseline GPOs and validated from HQ-CL01.

Validated controls:

  • LLMNR disabled
  • PowerShell module logging and transcription enabled
  • SmartScreen enabled in warning mode
  • Defender antivirus, real-time protection, IOAV, cloud reporting, and sample submission retained

The remaining security phases should continue as separate layers:

Proposed GPO Purpose
GPO-DC-Hardening Domain controller security controls
GPO-Servers-Hardening Member server security controls
GPO-Admins-Baseline Separate controls for admin user sessions or admin workstations
GPO-LAPS Local admin password management
GPO-Advanced-Auditing Audit policy and log fidelity
GPO-Defender-ASR Defender and attack surface reduction

This keeps the baseline readable and makes rollback easier.

The next practical order for this lab is:

  1. GPO-Admins-Baseline
  2. stricter controls for admin sessions
  3. no direct reuse of standard user settings without review
  4. GPO-LAPS
  5. GPO-Advanced-Auditing
  6. GPO-Defender-ASR

Do not place later settings into the existing baseline or validated hardening GPO until they are validated separately in the lab.

Script policy for next-phase GPO work

  • Only the currently validated GPO scripts belong in scripts/.
  • New hardening GPO scripts should not be promoted into scripts/ until they pass lab deployment and validation.
  • Draft logic for the next phase should stay in review documentation or review runbooks until validated.