The Windows Group Policy feature provides a centralized set of rules that govern the way Windows operates. It provides the ability to define and apply both general and security configuration changes to one or more computers. You can define both Local Group Policy settings and Group Policies in Active Directory. Local Group Policies control the behavior of a single computer. Active Directory Group Policies can apply to any users on any computers defined in Active Directory. Using Group Policy can make administration tasks easier than having to write scripts or individually secure basic security settings.

When booting a computer or logging on, Windows looks up and applies the GPOs for that computer and user. Group Policy uses a “pull” technology, which means that Windows periodically searches for any updated GPOs. If it finds a new GPO, it downloads and applies the changes to the existing environment. It pulls new or changed GPOs to the local computer and ensures that the settings are current. By default, Windows checks for new or updated GPOs at a random interval from 90 to 120 minutes. This automatic update feature ensures that Windows applies any new or updated GPOs, often without requiring that users log off or reboot computers.