If you haven't played around with implementing a lot of settings inside Group Policy before, you might be scratching your head a little at this point. The idea of self-regulating policies that remove their settings when the GPO no longer applies—that makes perfect sense, right? Isn't that simply the way that all GPO settings work?

Nope! There is another class of settings inside Group Policy that is not self-regulating, and does not have the ability to remove itself when its issuing GPO falls out of scope on a workstation. These settings get left behind, and continue to be present inside the registry of the machine long after the GPO has fallen away and is no longer applying to the computer.

Almost all of the GPO Policy settings that exist out of the box inside Group Policy will be self-regulating, so if you only ever use pre-built settings, you will rarely need to worry about this. At least not for Policies, so most of these stock settings are what I consider to be managed policies. What is perfectly critical to understand though, is that in any given deployment of Active Directory and Group Policy, the potential exists for there to be settings mixed into Administrative Templates, which are unmanaged. In other words, settings that apply to the workstation, and are then stuck in place. Even if you de-scope the GPO so that it no longer applies to that machine, these unmanaged settings will hang around in the registry and continue to be in effect on that computer.

The unmanaged settings are left behind on the workstation simply because they are settings that exist outside of those four special registry keys. Only settings inside those keys are re-evaluated every time that Group Policy processes. But the registry is enormous, right? So any settings that utilize keys or values inside the registry that sit outside of those four keys are not re-evaluated every time Group Policy runs, which means that those settings get left in place even when the GPO is no longer in scope and no longer being actively applied to a client computer.