Creating a new GPO is not rocket science, but walking through some examples will give us the opportunity to discuss some practices surrounding GPO creation that will be good to keep in mind. We have already modified an existing policy, but there is rarely a good reason for modifying the Default Domain Policy; much more commonly you will be creating brand-new GPOs for settings that you decide need to be rolled out to your workforce. Creating GPOs yourself will give you much more control over settings and filtering within your environment.

For this section, we are focusing on creating the object at GPMC level. Under the hood, a GPO is not really a single object but rather a combination of an AD object and some files that sit on the DCs. We will further discuss the "what and where" in Chapter 8, Group Policy Maintenance.