What are gpo in Active Directory?

Group Policy Objects (GPOs) are collections of settings for Windows operating systems.

In general terms, they are created for two reasons: to control the look and feel of the operating system and its functionality (the "user experience") or to govern the way the system works such as its security and operation.

Administrators have been able to apply policies to machines since Windows 9x/NT3 but with the advent of Active Directory in Windows 2000, GPOs have allowed a granular centralised control mechanism for domain members ranging across almost all aspects of the OS and many of the Microsoft products (primarily internet Explorer and the Office suite, although customisation allows virtually any application to be controlled).

Group Policy settings can apply either to the machine itself (and consequently apply to all users of that machine) or to groups of users of the machine. They grant the ability to standardise an estate.

In large organisations, they are used to control passWord policies, logon rights, privileges, permissions, registry settings, the desktop and the underlying security of the infrastructure. They are vital in maintaining control and governance.

As examples of their capabilities, you can set all machines to have the same colour scheme, screensaver, minimum passWord length/complexity, or any of the thousands of options available. They can be used to roll out software, fire startup and logon scripts, and enable/disable services, etc.