Group Policy Object (GPO) with Security policy to apply

 Group Policies (GPOs), short for Group Policy Objects, are a set of rules and configurations that can be applied to users and computers within a Windows-based network domain. GPOs are used to enforce security settings, control user and computer configurations, and manage the behavior of devices and software on the network.

 

Here are some common group policies that can be set for domain users:

1. Password Policy:

• Password Complexity: Enforce the use of strong passwords with complexity requirements (e.g., minimum length, use of uppercase, lowercase, numbers, and special characters).
• Password Expiration: Set password expiration policies, including password age and maximum password age.
• Account Lockout Policy: Configure the number of failed login attempts before an account is locked and the duration of lockout.

2. Account Lockout Policy:

• Account Lockout Threshold: Define the number of incorrect login attempts before an account is locked.
• Account Lockout Duration: Specify the amount of time an account remains locked before it can be unlocked or reset by an administrator.

3. Software Installation:

• Software Deployment: Deploy and manage software applications across the network. You can specify which software should be installed on user or computer accounts.
• Software Updates: Configure settings for Windows Update or Windows Server Update Services (WSUS) to manage updates and patches.

4. Folder Redirection:

• Redirect user folders (e.g., Documents, Desktop) to a network location, ensuring data is stored centrally for backup and management.

5. Desktop Security:

• Screen Lock Policies: Configure screen lock settings, including timeout and password requirements.
• Firewall Rules: Manage Windows Firewall settings to control inbound and outbound network traffic.
• Antivirus and Antispyware: Ensure that antivirus and antispyware software is enabled and up-to-date.

6. Internet Explorer Settings:

• Control the behavior and security settings of Internet Explorer, including proxy settings, trusted sites, and restrictions on downloading files.

7. Security Settings:

• Configure various security settings, such as:
  • User Rights Assignment: Control who can perform specific actions on computers.
  • Security Options: Set password policies, restrict access to devices, and configure network security.
  • Security Templates: Apply predefined security configurations to user and computer accounts.

8. Group Membership:

• Control which users are members of specific groups, granting or denying access to network resources accordingly.

9. Folder and File Permissions:

• Manage access control lists (ACLs) on network folders and files to restrict or allow access to specific users or groups.

10. Drive Mapping: - Configure drive mappings to network shares or specific directories for users.

11. User Environment: - Customize the user environment, including desktop settings, Start menu options, and user profile configurations.

12. Remote Desktop: - Control settings related to remote desktop access, including who can connect remotely and under what conditions.

13. Group Policy Preferences: - Use Group Policy Preferences to configure settings such as mapped drives, printers, and registry settings.

14. Restricted Groups: - Specify which users or groups are members of local groups on computers, providing centralized control over local group memberships.

15. Logon and Logoff Scripts: - Assign logon and logoff scripts to automate tasks or configurations when users log in or log off.

 ========================================================

Major Security Group Policy to Set after Domain Creation : 

1. Password Policy:

• Enforce Password Complexity: Configure policies to require strong passwords with a mix of characters (e.g., uppercase, lowercase, numbers, special characters).
• Password Expiration: Set password expiration policies, including maximum password age.
• Account Lockout Threshold: Define the number of failed login attempts before an account is locked.
• Account Lockout Duration: Specify the duration of an account lockout.

2. Account Logon Policies:

• Interactive Logon Restrictions: Control user access to computers interactively (e.g., console, Remote Desktop) by specifying which users or groups are allowed or denied.
• User Rights Assignment: Configure who has the right to perform specific actions (e.g., log on locally, shut down the system).

3. Restricted Groups:

• Control Group Memberships: Use restricted groups to control which users or groups are members of local groups on computers, such as the Administrators group.

4. Security Options:

• Network Security Settings: Configure various security options, including LAN Manager authentication levels, client and server communication security settings, and network encryption.
• Interactive Logon Settings: Define interactive logon behavior, such as disabling the Guest account or enabling the "Do not display last user name" option.

5. Account Policies:

• Audit Policy: Configure auditing settings to track specific events, such as logon events, object access, and privilege use.
• User Rights Assignment: Review and adjust user rights assignment to control who can perform critical actions on computers.

6. Firewall Settings:

• Windows Firewall with Advanced Security: Configure firewall rules and policies to control inbound and outbound network traffic, ensuring only authorized traffic is allowed.

7. Device Security:

• Device Installation Restrictions: Control which devices (e.g., USB drives) can be installed on computers.
• Device Installation Policies: Define how Windows handles the installation of new devices and drivers.

8. Software Restriction Policies:

• Application Control: Create policies to allow or disallow specific applications from running on computers.

9. Internet Explorer Settings:

• Security Zones and Content Ratings: Define security settings for Internet Explorer, including trusted sites and content ratings.

10. Group Policy Preferences:

• Drive and Printer Mappings: Use Group Policy Preferences to configure drive and printer mappings for users based on their roles and needs.

11. BitLocker Policies:

• BitLocker Drive Encryption: Configure policies for encrypting hard drives to protect data in case of theft or loss.

12. Advanced Security Settings:

• Credential Delegation: Control how credentials are delegated for network authentication, reducing the risk of credential theft.

13. Event Log Settings:

• Event Log Policies: Configure event log settings for retention, size, and event forwarding to ensure critical security events are captured.