Group Policy abuse

Server and client Windows operating systems have various parameters that can be enabled, disabled, or configured. It is possible to apply required parameters locally on each object (local policy), but in the domain, it is much more convenient to prepare and push configuration changes via Group Policy to a set of machines and/or users. These sets of policies are called the Group Policy Object (GPO). Each GPO has its own GUID. Policy files are stored in the domain SYSVOL folder. By default, GPO creation and linking are allowed only to users with domain administrator’s privileges, however, these permissions can be delegated. The GPO needs to be linked to Organizational Units, a domain, or a site. The linking process requires an understanding of two more concepts: inheritance and enforcement. If GPLink is enforced, the GPO will apply to the linked OU and all child objects even if inheritance is blocked. If GPLink is not enforced, the GPO will apply to the linked...