When making security hardening, for example, in a Windows server environment, often the same hardening settings are desired to be applied to all - not just to individual or current servers.

Group policies (Group Policy Objects or commonly GPO) are a feature of Windows that is part of Windows Active Directory. With GPOs, server administrators can centrally manage and configure operating system settings, applications, and user environments in Active Directory.

They are commonly used in business environments, schools, and other organizations where there is a need to manage large quantities of computers and users.

Defines settings such as background image, network printers, or security updates.

Prevent or allow access to certain programs or Windows features.

Configure security settings such as firewall and antivirus regulations.

To perform other cybersecurity hardening measures.

Open Group Policy Management (GPM) by searching for it with the Windows button search:

Expand the scope you want to create a GPO for. In this case, evilcorp.local.

Right-click the organizational unit (OU) you want the policy to apply to and select "Create a new GPO in this domain, and Link it here".

Click on GPO and select "Edit" to open the Group Policy Management Editor. From here, you can configure user and computer-specific policies. Settings are divided into two main categories: "User Settings" and "Computer Settings".

You can now edit the GPO. For example, if you want to disable the Task Manager, you can do so as follows:

User Configuration > Administrative Templates > System > Ctrl+Alt+Del Options.

Once you have configured the desired settings, close the editor. The GPO will be automatically applied according to the schedule defined by the AD, or you can force the update by using the command "gpupdate /force" on the target machine.

Open PowerShell and run it as an administrator (right-click and "Run as administrator").

The changes should now be effective on the server on which you executed the command.

Prevent the use of task manager as described above. Then try to open it:

The lab takes a couple of minutes to start up, please wait patiently and add more time if needed. You don't need to close the lab between switching modules in this course. You can log in to the server via RDP with the username "

Windows practice

## What are group policies?

When making security hardening, for example, in a Windows server environment, often the same hardening settings are desired to be applied to all - not just to individual or current servers.

Group policies (Group Policy Objects or commonly GPO) are a feature of Windows that is part of Windows Active Directory. With GPOs, server administrators can centrally manage and configure operating system settings, applications, and user environments in Active Directory.

They are commonly used in business environments, schools, and other organizations where there is a need to manage large quantities of computers and users.

---

## What can be done with GPO?

With GPOs, you can, among other things:

- Defines settings such as background image, network printers, or security updates.
- Prevent or allow access to certain programs or Windows features.
- Configure security settings such as firewall and antivirus regulations.
- Manage user profiles and login scripts.
- To perform other cybersecurity hardening measures.

---

## How to use GPOs?

Open Group Policy Management (GPM) by searching for it with the Windows button search:

![](sanity:image-68a5f23c9f3c4d5967c476b18de5a36e4b2c52c5-1500x1276-png)

Expand the scope you want to create a GPO for. In this case, evilcorp.local.

![](sanity:image-14eafbde4a8113821683c656d5e3277831f0da02-814x494-png)

### Creating a New GPO

Right-click the organizational unit (OU) you want the policy to apply to and select "Create a new GPO in this domain, and Link it here".

### Modifying existing GPO

Click on GPO and select "Edit" to open the Group Policy Management Editor. From here, you can configure user and computer-specific policies. Settings are divided into two main categories: "User Settings" and "Computer Settings".

![](sanity:image-0d98824657ecb2089d312e1607ee5c0356d018b2-686x258-png)

![](sanity:image-dd2351944688e6b69d42640997f80f165e469cb0-1392x654-png)

### Creating a new rule

You can now edit the GPO. For example, if you want to disable the Task Manager, you can do so as follows:

- Expand the tree structure as follows: **User Configuration > Administrative Templates > System > Ctrl+Alt+Del Options.**

![](sanity:image-70ce45ee208810e2df5aa8f61ddc19d972ea373c-1550x682-png)

- Double click **"Remove Task Manager".**
- Change the value to "Enabled".

![](sanity:image-45f939b7942bf111dd87ea8ae7745a4ff1bc8470-706x430-png)

- Press "OK" in the end.

### Implementation of Updated Policy

Once you have configured the desired settings, close the editor. The GPO will be automatically applied according to the schedule defined by the AD, or you can force the update by using the command "gpupdate /force" on the target machine.

Open PowerShell and run it as an administrator (right-click and "Run as administrator").

![](sanity:image-fe81c080ba7cc00efff00acf420ed60119823236-1204x1294-png)

Then execute **gpupdate /force**

![](sanity:image-b0cd041ad1fa9529176506651bc8b1a8bac7921f-882x344-png)

The changes should now be effective on the server on which you executed the command.

---

## Exercise

Prevent the use of task manager as described above. Then try to open it:

![](sanity:image-a36516b2a9020ebc719325d3f84a119439dfd618-1710x1290-png)

@exercise 8c0eb23215a1

@exercise af2a1ec3ebcc


Group Policies (Group Policy Objects / GPO)

In this course, we go through the basics related to managing Windows systems and maintaining information security.

In this course, we will go through the basics of Windows system administration and cybersecurity maintenance.

We familiarize ourselves with Windows virus protection, firewall, and automatic updates. We learn to use remote desktop connections, registry editor, PowerShell, server manager, and group policies.

The course does not go into great depth on Windows domains, attacks on them, or hardening. These more advanced topics are covered in the "Windows - Attack and Defense" course.

Group Policies (Group Policy Objects / GPO)

What are group policies?

Learn to hack — start here