AD enables admins to manage sets of multiple objects known as groups. Using GPOs (group policy objects), an admin can make a change to one group and have that change apply to all objects within that group. They’re often used to segment users or systems by department or clearance.