Advanced Group Policy: loopback, WMI filters and backups

Start DC01, SRV01 and CL01. Work on DC01 as SAATLAB\Administrator in PowerShell as administrator, and keep Group Policy Management open.

1Create the central store

On DC01, copy the local templates into SYSVOL:

$store = '\\saatlab.internal\SYSVOL\saatlab.internal\Policies\PolicyDefinitions'
Copy-Item C:\Windows\PolicyDefinitions $store -Recurse
Test-Path "$store\en-US"

You should see this:

True

Edit any GPO and click Administrative Templates. The heading now says the policy definitions were retrieved from the central store. When new Windows versions add settings, download Microsoft’s latest ADMX package and update this one folder.

✅ Checkpoint: Administrative Templates shows “retrieved from the central store” in the editor.

2Back up every GPO

On DC01, run this:

New-Item -ItemType Directory C:\GPOBackups -Force | Out-Null
Backup-GPO -All -Path C:\GPOBackups | Select-Object DisplayName, Id | Format-Table -AutoSize

You should see something like this:

DisplayName                       Id
-----------                       --
U-Finance-Printer                 7c2e4b1a-0d3f-4e59-9a61-2b8c5d7e9f10
Default Domain Controllers Policy d41b9e6c-8a2f-4c37-b5e0-1f6a3c9d2e84
Default Domain Policy             3f8a1c5e-6b2d-4f90-8e7a-9c0d1b2e3f45
U-Staff-Desktop                   a9d3e7f1-2c4b-4d68-91e0-5b7c3a8f6d22

Each Id is a backup folder under C:\GPOBackups. In production, keep these off the DC and run the backup on a schedule (Lesson 27 turns it into a scheduled task).

✅ Checkpoint: Four backups exist in C:\GPOBackups.

3Target a computer GPO with a WMI filter

First test the query on CL01 (PowerShell as administrator):

Get-CimInstance -Query "SELECT * FROM Win32_OperatingSystem WHERE ProductType = 1 AND Version LIKE '10.0.2%'" | Select-Object Caption, Version

You should see something like this:

Caption                                    Version
-------                                    -------
Microsoft Windows 11 Enterprise Evaluation 10.0.26200

ProductType 1 means a workstation, and Windows 11 versions start with 10.0.2 (build 22000 and later). On a server the query returns nothing, so the GPO won’t apply there.

In Group Policy Management, right-click WMI Filters, choose New, name it Windows 11 only, click Add, and paste the query (namespace root\CIMv2). Save it.

On DC01, create the GPO, give it one setting and link it:

New-GPO -Name 'C-Workstation-Security' | New-GPLink -Target 'OU=Workstations,OU=SAATLAB,DC=saatlab,DC=internal' | Out-Null
Set-GPRegistryValue -Name 'C-Workstation-Security' -Key 'HKLM\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint' -ValueName RestrictDriverInstallationToAdministrators -Type DWord -Value 1 | Out-Null

Select C-Workstation-Security in GPMC and, at the bottom of the Scope tab, choose Windows 11 only under WMI Filtering. The setting keeps printer driver installs admin-only, as you learned in Lesson 18.

On CL01, refresh and check:

gpupdate /force
gpresult /r /scope computer | Select-String 'C-Workstation'
Get-ItemProperty 'HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint' | Select-Object RestrictDriverInstallationToAdministrators

You should see something like this:

        C-Workstation-Security

RestrictDriverInstallationToAdministrators
------------------------------------------
                                         1

✅ Checkpoint: C-Workstation-Security applies to CL01 and the registry value is 1.

4Loopback on a Kiosks OU

On DC01, create the OU and a loopback GPO in Merge mode with one user setting:

New-ADOrganizationalUnit -Name Kiosks -Path 'OU=Workstations,OU=SAATLAB,DC=saatlab,DC=internal'
New-GPO -Name 'C-Kiosk-Loopback' | New-GPLink -Target 'OU=Kiosks,OU=Workstations,OU=SAATLAB,DC=saatlab,DC=internal' | Out-Null
Set-GPRegistryValue -Name 'C-Kiosk-Loopback' -Key 'HKLM\Software\Policies\Microsoft\Windows\System' -ValueName UserPolicyMode -Type DWord -Value 1 | Out-Null
Set-GPRegistryValue -Name 'C-Kiosk-Loopback' -Key 'HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer' -ValueName NoControlPanel -Type DWord -Value 1 | Out-Null
Get-ADComputer CL01 | Move-ADObject -TargetPath 'OU=Kiosks,OU=Workstations,OU=SAATLAB,DC=saatlab,DC=internal'

UserPolicyMode 1 is Merge (2 is Replace). That’s the loopback setting under Computer Configuration, System, Group Policy. NoControlPanel is a user setting, but it sits in a GPO linked to a computer OU, which only works because of loopback.

Restart CL01 (computer settings and the OU move need it), then sign in as Priya and try to open Control Panel. You’ll get a message that the operation has been cancelled due to restrictions in effect on this computer.

Then move CL01 back so later lessons behave as expected:

Get-ADComputer CL01 | Move-ADObject -TargetPath 'OU=Workstations,OU=SAATLAB,DC=saatlab,DC=internal'

✅ Checkpoint: Control Panel was blocked for Priya on CL01 while it was in Kiosks, and CL01 is back in Workstations.

5Item-level targeting: an F: drive for Finance only

Edit U-Staff-Desktop, go to User Configuration, Preferences, Windows Settings, Drive Maps and add a mapped drive: Update, \\saatlab.internal\Files\Departments\Finance, letter F, label Finance.

On its Common tab, tick Item-level targeting, click Targeting, then New Item, Security Group, choose SAATLAB\GG_Finance, and click OK twice. Priya gets F: at her next sign-in; Sneha in IT doesn’t, from the same GPO.

✅ Checkpoint: After signing in again, Priya has both S: and F:.

6Report what applies, and model before you link

On DC01, produce an RSoP report for Priya on CL01:

New-Item -ItemType Directory C:\Temp -Force | Out-Null
Get-GPResultantSetOfPolicy -User 'SAATLAB\priya.sharma' -Computer CL01 -ReportType Html -Path C:\Temp\priya-cl01.html
Start-Process C:\Temp\priya-cl01.html

The report lists every applied and denied GPO for both halves, the winning GPO for each setting, and any errors. For “what would happen if…”, use Group Policy Modeling in GPMC: pick a user, a computer and their OUs, and it predicts the result before you link anything.

✅ Checkpoint: The HTML report opens and lists U-Staff-Desktop, U-Finance-Printer and C-Workstation-Security.

7Redirect Documents to SRV01

On SRV01, create the share with the permissions Microsoft recommends for Folder Redirection:

New-Item -ItemType Directory D:\Redirect | Out-Null
icacls D:\Redirect /inheritance:r /grant:r "SYSTEM:(OI)(CI)F" "BUILTIN\Administrators:(OI)(CI)F" "CREATOR OWNER:(OI)(CI)(IO)F" "Authenticated Users:(RD,AD,RA,X)"
New-SmbShare -Name 'Redirect$' -Path D:\Redirect -FullAccess 'NT AUTHORITY\Authenticated Users' -FolderEnumerationMode AccessBased | Out-Null

Users can create their own folder in the root but not see others; CREATOR OWNER gives each user full control of what they create. On DC01, create a GPO U-Folder-Redirection linked to Staff, and edit it: User Configuration, Policies, Windows Settings, Folder Redirection, Documents, Properties.

Choose Basic, Create a folder for each user under the root path, and root path \\SRV01\Redirect$. Click OK and accept the warning.

On CL01, sign Priya out and in (sometimes twice), then check:

[Environment]::GetFolderPath('MyDocuments')

You should see this:

\\SRV01\Redirect$\priya.sharma\Documents

✅ Checkpoint: Priya’s Documents folder now lives on SRV01. Take snapshots called “GP advanced” of DC01, SRV01 and CL01.