Lab 3 — Group Policy & Delegation

Goal: build a realistic OU structure, write Group Policies, break them, and diagnose the break. Time: ~3 hours.

This is the lab that makes "Experience with Active Directory & Group Policies" true on your resume.

Part 1 — Build the OU structure

# Top-level departments
New-ADOrganizationalUnit -Name "CORP" -Path "DC=corp,DC=local" -ProtectedFromAccidentalDeletion $true

New-ADOrganizationalUnit -Name "IT"       -Path "OU=CORP,DC=corp,DC=local" -ProtectedFromAccidentalDeletion $true
New-ADOrganizationalUnit -Name "Finance"  -Path "OU=CORP,DC=corp,DC=local" -ProtectedFromAccidentalDeletion $true
New-ADOrganizationalUnit -Name "HR"       -Path "OU=CORP,DC=corp,DC=local" -ProtectedFromAccidentalDeletion $true

# Sub-OUs under IT — this is what a real support environment looks like
New-ADOrganizationalUnit -Name "Workstations" -Path "OU=IT,OU=CORP,DC=corp,DC=local"
New-ADOrganizationalUnit -Name "Servers"     -Path "OU=IT,OU=CORP,DC=corp,DC=local"
New-ADOrganizationalUnit -Name "Kiosks"      -Path "OU=IT,OU=CORP,DC=corp,DC=local"
New-ADOrganizationalUnit -Name "ServiceAccounts" -Path "OU=IT,OU=CORP,DC=corp,DC=local"

# Computers into their OU rather than the default CN=Computers
Get-ADComputer -Filter * | Where-Object {$_.Name -eq "SRV01"} |
  Move-ADObject -TargetPath "OU=Servers,OU=IT,OU=CORP,DC=corp,DC=local"

Computers that stay in CN=Computers receive nothing targeted by OU-based policy. Moving them is a real support task, and knowing it is a genuinely differentiating detail.

Part 2 — Create users and groups

New-ADGroup -Name "IT Support"  -GroupScope "Global"     -Path "OU=IT,OU=CORP,DC=corp,DC=local"
New-ADGroup -Name "Finance Staff" -GroupScope "Global"   -Path "OU=Finance,OU=CORP,DC=corp,DC=local"

New-ADUser -Name "Ravi Kumar" -SamAccountName "ravi" `
  -Path "OU=IT,OU=CORP,DC=corp,DC=local" `
  -AccountPassword (ConvertTo-SecureString "Passw0rd!2026" -AsPlainText -Force) `
  -Enabled $true -PasswordNeverExpires $false

New-ADUser -Name "Priya Shah" -SamAccountName "priya" `
  -Path "OU=Finance,OU=CORP,DC=corp,DC=local" `
  -AccountPassword (ConvertTo-SecureString "Passw0rd!2026" -AsPlainText -Force) `
  -Enabled $true

Add-ADGroupMember -Identity "IT Support" -Members "ravi"

Part 3 — Write a real GPO

Install the GPMC feature first:

Install-WindowsFeature GPMC -IncludeManagementTools

Policy A — lock down Finance workstations

New-GPO -Name "Finance Workstation Lockdown" | Out-Null

# Disable USB mass storage
Set-GPRegistryValue -Name "Finance Workstation Lockdown" `
  -Key "HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard" `
  -ValueName "EnableInteractiveLogon" -Type DWord -Value 1

Set-GPRegistryValue -Name "Finance Workstation Lockdown" `
  -Key "HKLM\SOFTWARE\Policies\Microsoft\Windows\Explorer" `
  -ValueName "NoDrives" -Type DWord -Value 4   # D: blocked

# Force a lock screen after 10 minutes idle
Set-GPRegistryValue -Name "Finance Workstation Lockdown" `
  -Key "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" `
  -ValueName "InactivityTimeoutSecs" -Type DWord -Value 600

Link it:

$gpo = Get-GPO -Name "Finance Workstation Lockdown"
$gpo | New-GPLink -Path "OU=Finance,OU=CORP,DC=corp,DC=local"

Link to OU=Finance, not to a user. Finance users could be anywhere; the machine is what gets locked down. Linking to a user object applies computer configuration to a machine that user happens to log on to.

Policy B — mapped drive for IT

New-GPO -Name "IT Mapped Drives" | Out-Null
$p = (Get-GPO -Name "IT Mapped Drives").GpoStatus
$p | Out-Null

$action = New-ScriptBlockAction -Body 'New-PSDrive -Name "Projects" -PSProvider FileSystem -Root "\\fs01\Projects" -Persist'
$g = Get-GPO -Name "IT Mapped Drives"
Set-GPTrivialgpoRegistryValue -ErrorAction SilentlyContinue

That last path is fiddly. The cleaner approach is a Group Policy Preferences logon script, or simply demonstrate it through the GUI once. What matters for the interview is that you can describe how you would deploy a mapped drive via GPP.

Apply and verify

gpupdate /force
Start-Process mmc.exe
gpresult /r /user:ravi

Part 4 — Break it deliberately

Now make it fail in the way real environments fail.

Break 1 — the wrong OU

Move-ADObject -Identity "CN=SRV01,CN=Computers,DC=corp,DC=local" `
  -TargetPath "OU=HR,OU=CORP,DC=corp,DC=local"

SRV01 now sits under HR, so the Finance lockdown no longer reaches it.

gpresult /r          # on SRV01

You will see the Finance GPO listed as not applied, with the reason given as being outside the OU's scope.

"'It works for everyone except me'" is nearly always one of four things: wrong OU, blocked link, wrong loopback processing, or security group filtering. gpresult /r tells you which, and why.

Break 2 — a blocked link

$gp = Get-GPO -Name "Finance Workstation Lockdown"
# Block it on a child OU
$gp | Set-GPBlockInheritance -Path "OU=Workstations,OU=IT,OU=CORP,DC=corp,DC=local"

Break 3 — security group filtering

Set-GPLink -Name "Finance Workstation Lockdown" `
  -Path "OU=Finance,OU=CORP,DC=corp,DC=local" `
  -Enforced $true

Enforced overrides child-OU blocking — so this fixes Break 2, and breaks anything a child OU wanted to set. Knowing the difference between blocked and enforced is a directly testable point.

Part 5 — Diagnose with gpresult

gpresult /r                        # Resultant Set of Policy
gpresult /h C:\gpo-report.html     # full HTML report
gpresult /r /scope:computer

The RSOP shows, for every GPO: whether it applied, which link it came from, the security filtering, and the order. That output is the answer to almost any Group Policy question.

# Find machines that did NOT receive a GPO
Get-ADComputer -Filter * -Properties * | Where-Object {
  $_.OperatingSystem -like "*Windows*"
} | ForEach-Object {
  $r = Invoke-Command -ComputerName $_.Name -ScriptBlock { gpresult /r } -ErrorAction SilentlyContinue
  if ($r -notmatch "Finance Workstation Lockdown") { $_.Name }
}

Part 6 — Delegation

Give the helpdesk the right to reset passwords and manage computers in the IT OU — not Domain Admin:

# Add the helpdesk group as a delegate on the IT OU
$ou = Get-ADOrganizationalUnit -Identity "OU=IT,OU=CORP,DC=corp,DC=local"
$acl = Get-Acl $ou.DistinguishedName

$rule = New-Object System.DirectoryServices.ActiveDirectoryAccessRule(
    "CORP\IT Support",
    "Read, CreateChild",
    "Container",
    "None",
    "Allow"
)
$acl.AddAccessRule($rule)
Set-Acl -Path $ou.DistinguishedName -AclObject $acl

Then check it worked:

dsacls "OU=IT,OU=CORP,DC=corp,DC=local"

"Helpdesk staff get a delegated OU with the Reset password right and Create computer objects right. They are never made Domain Admins — that way a compromised helpdesk account cannot control the entire domain."

Part 7 — Loopback processing

On the Kiosks OU, configure the linked GPO: Edit → Advanced → Computer Configuration. Set loopback to Merge, then log on at a kiosk and confirm the user's wallpaper is applied to the machine.

Switch it to Replace and confirm the computer settings now win. You can now explain it from having seen it.

Verification

0 / 7 complete

Three-tier OU structure created and a computer moved into it
A real GPO written and linked to the correct OU
Deliberately broken the OU scope and diagnosed it with gpresult /r
Demonstrated blocked vs enforced links
Delegated an OU to a helpdesk group without granting Domain Admin
Configured loopback processing and observed both modes
Screenshots of the OU tree and the gpresult report committed

Hints

Details

gpresult shows the GPO as "not applied"

Read the reason under each GPO. It will name one of: the object is outside the OU scope, a child OU blocked it, security group filtering excluded it, or user and computer settings were filtered for that user.

Details

Can't find New-GPO

Install-WindowsFeature GPMC -IncludeManagementTools, then restart the PowerShell session.

Solution

Show the diagnostic sequence

The commands you would actually run when a policy isn't applying:

# 1. Where is the object?
Get-ADComputer -Identity "SRV01" | Select-Object Name, DistinguishedName

# 2. What links exist, and in what order?
Get-ADOrganizationalUnit -Filter * -Properties LinkedGroupPolicy |
  Select-Object Name, LinkedGroupPolicy

# 3. What actually applied, and why?
gpresult /r

# 4. Force and re-check
gpupdate /force
gpresult /h C:\after.html

That four-step sequence — locate, inspect links, read the RSOP, re-apply — is the complete answer, and it is what you should say if asked how you would diagnose a policy problem.

Lab 4 — Firewall, VLANs & VPN.

Was this page helpful?

Part 1 — Build the OU structure​

Part 2 — Create users and groups​

Part 3 — Write a real GPO​

Policy A — lock down Finance workstations​

Policy B — mapped drive for IT​

Apply and verify​

Part 4 — Break it deliberately​

Break 1 — the wrong OU​

Break 2 — a blocked link​

Break 3 — security group filtering​

Part 5 — Diagnose with gpresult​

Part 6 — Delegation​

Part 7 — Loopback processing​

Verification​

Hints​

Solution​

Next​