Administrative tool: A tool that is used to administer policy settings. The primary interests of the Administrative tool are as follows: Enabling Group Policy administrators to create, update, and delete policy settings by writing and reading policy information to and from the logical and file system components of GPOs. Supporting services: The services that provide a common infrastructure to support Policy operations: Remote file services [MS-FASOD] LDAP directory services Domain controller discovery ( (section 3.1.1)) WMI services Authentication services: The authentication services specified in provide identity, authentication, and authorization services through NTLM or Kerberos to secure communications in Group Policy. This includes authentication services that support client-to-server communication within Group Policy. Use Case Diagram The following diagram two Group Policy use cases: Applying Group Policy - Group Policy client Administering Group Policy - Group Policy administrator Figure : Group Policy use case diagram Applying Group Policy — Group Policy Client Goal The goal of this use case is to retrieve Group Policy information from the Group Policy server and to apply policy settings on the Group Policy client. Context of use Group Policy is applied after the Group Policy client contacts the Group Policy server and successfully retrieves new or updated content. Based on the SOM, the client retrieves the list of GPOs for policy application, as described in section 3.2.5.1.5. Actors Group Policy client: Maintains a policy configuration that is consistent with the policy information that is stored on the Group Policy server. This is the primary actor. The primary interests of the Group Policy client are to: Retrieve policy content from the Group Policy server. Ensure that policy settings defined by the Group Policy administrator are enforced on the Group Policy client computer.
Group Policy Scripts Extension: Protocol Specification Processing Events and Sequencing Rules Periodic Computer Core Policy Application [MS-GPOL]: Group Policy: Core Protocol Specification 1.3.3, Policy Application Periodic Computer CSE Policy Application [MS-GPOL]: Policy: Core Protocol Specification 3.2.5.1.10, Extension Protocol Sequences Periodic User Policy Core Application [MS-GPOL]: Group Policy: Core Protocol Specification 1.3.3, Policy Application Periodic User CSE Policy Application [MS-GPOL]: Group Policy: Core Protocol Specification 3.2.5.1.10, Extension Protocol Sequences User Logoff Scripts Group Policy Scripts Extension: Protocol Specification 3.2.5, Message Processing Events and Sequencing Rules Computer Shutdown Scripts Group Policy Scripts Extension: Protocol Specification 3.2.5, Message Processing Events and Sequencing Rules Example 2: Applying Policy on the Policy Client The Group Policy client's interaction with the Group Policy server in policy application uses a pull model, in which the Group Policy client polls a Group Policy server to check for new user GPOs. When the Policy client discovers the Group Policy server, the client performs two sets of queries to Active Directory on the Group Policy server using LDAP as a transport. The first set of queries determines which GPOs have been assigned. The second set of queries determines attributes of the relevant policies, discovers the location of the policy files, and determines any exclusionary WMI filtering for GPOs.
Microsoft Implementations Note: Some of the information in this section is subject to change because it applies to a preliminary product version, and thus may differ from the final version of the software when released. All behavior notes that pertain to the preliminary product version contain specific references to it as an aid to the reader. The information in this specification is applicable to the following versions of Windows: Windows 2000 operating system Windows XP operating system Windows Server 2003 operating system Windows Server 2003 R2 operating system Windows Vista operating system Windows Server 2008 operating system Windows 7 operating system Windows Server 2008 R2 operating system Windows 8 operating system Windows Server 2012 operating system Windows 8.1 operating system Windows Server 2012 R2 operating system Windows 10 operating system Windows Server 2016 Technical Preview operating system Exceptions, if any, are noted in the following section. Product Behavior <1> Section 1.1.3: The Microsoft implementation of the directory service for the Policy protocols is Active Directory Domain Services (AD DS) (see ). <2> Section 1.1.3: The Microsoft implementation of the Group Policy file share repository is a system volume (SYSVOL) share on the Group Policy server. <3> Section 1.1.5: In Windows implementations, the Group Policy protocols use file access protocols, as specified in for file access operations. <4> Section 2.1.3.1.6: For Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2, Windows 8, Windows Server 2012, Windows 8.1, Windows Server 2012 R2, Windows 10, and Windows Server 2016 Technical Preview, Group Policy queries the operating system directly to determine link speed. Windows 2000, Windows XP, and Windows Server 2003 use ICMP to determine the link speed between the Group Policy client and the domain controller. Use the following algorithm to determine the link speed when ICMP is used. Form an ICMP Echo request with a packet size between 500 and 2,048
Protocol syntax refers to data elements (such as packets, structures, enumerations, and methods) as well as interfaces. Protocol revision refers to changes made to a protocol that affect the bits that are sent over the wire. The changes made to this document are listed in the following table. For more information, please contact . Section Tracking number (if applicable) and description Major change (Y or N) Change type Protocol Summary Removed [MS-GPIE] and and added Y Content update. Dependencies on Group Policy Protocols Removed reference to Network Access Protection. Y Content update.