Group Policy is a built-in Windows feature that allows admins to centrally manage and enforce configuration settings for users and computers in an Active Directory (AD) environment. It provides a consistent way to control system behavior, security settings, user experience, and application configuration across many machines from a single point. These settings are defined, organized, and applied through Group Policy Objects (GPOs), which act as containers for related policy configurations and determine how and where Group Policy is enforced.
A well-structured GPO strategy lets admins roll out new baselines, application settings, or hardening measures quickly and consistently, instead of configuring machines individually. This page explains how to create new GPOs using the Group Policy Management Console (GPMC), PowerShell, and ManageEngine ADManager Plus, helping you choose the approach that best fits your workflow.
PowerShell's New-GPO cmdlet in the GroupPolicy module lets you create GPOs programmatically, optionally based on a starter GPO, and then link them with other cmdlets such as New-GPLink.
Import-Module GroupPolicy
You can use the New-GPO cmdlet to create a GPO, then optionally link it to a site, domain, or OU with New-GPLink and configure settings with other GPO cmdlets.
This creates a new, unlinked GPO named “Workstation Baseline” in the current domain, with a descriptive comment.
New-GPO -Name "Workstation Baseline" -Comment "Baseline security settings for client machines"
This creates a new GPO and pre-populates it with settings copied from the specified starter GPO, saving time and ensuring consistency.
New-GPO -Name "Server Hardening GPO" -StarterGpoName "Windows Server Baseline"
This creates the “HR Desktop Policy” GPO and links it to the HR OU so that it starts applying to users and computers under that OU.
New-GPO -Name "HR Desktop Policy" |
New-GPLink -Target "OU=HR,DC=contoso,DC=com" -LinkEnabled Yes
This enables a policy setting by writing a registry value inside the GPO.
Set-GPRegistryValue `
-Name "Workstation Baseline" `
-Key "HKLM\Software\Policies\Microsoft\Windows\System" `
-ValueName "EnableSmartScreen" `
-Type DWord `
-Value 1
This links the Workstation Baseline GPO to the Finance OU so it applies to users and computers in that OU.
New-GPLink -Name "Workstation Baseline" -Target "OU=Finance,DC=contoso,DC=com"
The following essential parameters can be used for creating GPOs in PowerShell.
| Cmdlet/Parameter | Description |
|---|---|
| New-GPO | Creates a new unlinked GPO in the specified or current domain. |
| -Name | Name of the new GPO (required). |
| -Comment | Optional descriptive text explaining the GPO's purpose. |
| -Domain | FQDN of the domain where the GPO should be created. |
| -Server | Domain controller to target for the operation. |
| -StarterGpoName -StarterGpoGuid | Creates the GPO based on an existing starter GPO template. |
| New-GPLink | Links a GPO to a site, domain, or OU and controls link status. |
The GPMC provides a graphical interface for creating and linking GPOs, suitable for admins who prefer a point-and-click approach:
ADManager Plus provides a web-based interface to create and manage GPOs, allowing you to create and link them to multiple OUs, domains, and sites in one step, without directly using GPMC or PowerShell.
Note: ADManager Plus lets you force GPO updates without the gpupdate cmdlet to instantly deploy critical security policies without waiting for scheduled refresh cycles.
While powerful, relying solely on PowerShell and GPMC for GPO creation can present several challenges:
ADManager Plus , an Active Directory management and reporting solution, helps admins perform GPO creation and management tasks with a script-free, intuitive interface.
This option is greyed out when you don't have sufficient permissions to create or link GPOs. You must be a Domain Admin or Enterprise Admin, or your role must have delegated Create GPOs and Link GPOs rights for the domain or OU. The option may also be unavailable if you right-click an object that does not support GPO linking, such as a non-OU container.
A starter GPO is a reusable template that contains predefined Administrative Template settings. It helps standardize configurations and speed up GPO creation. Starter GPOs are created in the Starter GPOs node in Group Policy Management and can be used as a baseline when creating new GPOs, but they cannot be linked directly to domains or OUs.
To apply a GPO to a user, link the GPO to the OU that contains the user account and configure settings under User Configuration. If the policy must follow the user regardless of the computer they sign in to, ensure the user object is placed in the correct OU and that no conflicting GPOs override the settings.
You can create a new GPO by copying an existing GPO in Group Policy Management. Right-click the source GPO, select Copy, then paste it into Group Policy Objects. This creates a new GPO with identical settings, which can be renamed and modified independently.
Computer Configuration applies settings to computers, regardless of which user signs in, and is processed during system startup.
User Configuration applies settings to user accounts, is processed during logon, and follows users as they sign in to different computers.
Effective GPO names are clear, descriptive, and purpose-driven. Common conventions include:
Example: Computer_Security_Baseline_Windows10
Yes, GPOs can be migrated between domains using GPMC backup and import or migration tables. Migration tables help map domain-specific values such as security principals and UNC paths, ensuring the imported GPO functions correctly in the target domain. ADManager Plus provides a script-free, easy-to-use GUI to simplify GPO migrations.