Top 10 Group Policy Objects for Administrators –

These ten Group Policy Objects give the biggest security and manageability return in an Active Directory domain, and every domain should have them in place. Each entry below lists the policy path, recommended values and why it matters.

• Audience: Domain and systems administrators who create, link and maintain GPOs.
• Scope: Windows Server 2016+ domain controllers and member servers; Windows 10/11 workstations.
• Prerequisites: Group Policy Management Console (GPMC) via RSAT, Domain Admin or delegated GPO rights, and current ADMX templates in the Central Store (\\<domain>\SYSVOL\<domain>\Policies\PolicyDefinitions).
• Baseline note: Values align with the Microsoft Security Baselines and CIS benchmarks. Always pilot in a test OU before linking to production.

Top 10 at a glance

Detailed configuration

All paths start under Computer Configuration > Policies unless noted.

1. Password and Account Lockout

Path: Windows Settings > Security Settings > Account Policies

Why: Stops password spraying and brute force. Domain account password policy only applies when linked at the domain root, so set it in the Default Domain Policy. Use Fine-Grained Password Policies (PSOs) for stricter rules on admin or service accounts.

2. Windows LAPS

Path: Administrative Templates > System > LAPS

Why: Gives every machine a unique, rotating local admin password, which breaks pass-the-hash lateral movement. Run Update-LapsADSchema and Set-LapsADComputerSelfPermission before linking.

3. Local Administrators Membership

Path: Computer Configuration > Preferences > Control Panel Settings > Local Users and Groups (or Windows Settings > Security Settings > Restricted Groups)

• Action Update on Administrators (built-in), with Delete all member users and Delete all member groups checked.
• Add only a dedicated AD group per tier, for example GG-Workstation-Admins or GG-Server-Admins.

Why: Removes ad-hoc local admin rights that accumulate over time. Group Policy Preferences is more flexible; Restricted Groups replaces the whole membership on every refresh.

4. Privileged Account Logon Restrictions

Path: Windows Settings > Security Settings > Local Policies > User Rights Assignment

Why: Enforces the tiered admin model so Tier 0 credentials are never cached on machines an attacker can more easily compromise. Never link this GPO to the Domain Controllers OU. Also add admin accounts to the Protected Users group.

5. Advanced Audit and PowerShell Logging

Path: Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies

Also set:

• Security Options > Audit: Force audit policy subcategory settings to override audit policy category settings = Enabled
• Administrative Templates > System > Audit Process Creation > Include command line in process creation events = Enabled
• Administrative Templates > Windows Components > Windows PowerShell > Turn on PowerShell Script Block Logging = Enabled
• Administrative Templates > Windows Components > Event Log Service > Security > Specify the maximum log file size = 196,608 KB or larger

Why: Without these events there is no detection or forensic trail. Forward them to a SIEM or Windows Event Forwarding collector.

6. Windows Update

Path: Administrative Templates > Windows Components > Windows Update

Why: Keeps patching consistent and predictable. Create separate GPOs per deployment ring (Pilot, Broad, Servers) rather than one policy for everything.

7. Microsoft Defender Antivirus and ASR

Path: Administrative Templates > Windows Components > Microsoft Defender Antivirus

Priority ASR rules to block: credential stealing from LSASS, Office apps creating child processes, executable content from email and webmail, obfuscated scripts, and Win32 API calls from Office macros.

Why: ASR rules stop the most common ransomware and phishing entry techniques. Run in Audit mode for 2–4 weeks and review event ID 1122 before switching to Block.

8. Windows Defender Firewall

Path: Windows Settings > Security Settings > Windows Defender Firewall with Advanced Security

Why: A host firewall limits lateral movement even inside the trusted network. Define required inbound rules (RDP from admin subnets, management agents) in the same GPO.

9. Legacy Protocol Hardening

Paths: Administrative Templates > Network > DNS Client, Security Settings > Local Policies > Security Options, and MS Security Guide (requires SecGuide.admx from the Microsoft Security Compliance Toolkit)

Why: SMBv1, LLMNR and unsigned SMB are the main paths for relay and poisoning attacks (such as Responder). Disable NetBIOS over TCP/IP through DHCP or adapter settings, as there is no native GPO for it.

10. Credential Guard and LSA Protection

Path: Administrative Templates > System

Why: Isolates NTLM hashes and Kerberos tickets from LSASS so credential-dumping tools cannot read them. UEFI lock prevents remote disabling, so test on pilot hardware first; do not enable Credential Guard on domain controllers.

Deployment best practices

Roll out each GPO in this order so a bad setting reaches a few test machines, not the whole domain.

1. Back up first. Run Backup-GPO -All -Path \\server\GPOBackups before any change.
2. One function per GPO. Name them clearly, for example SEC - Workstations - LAPS or SEC - All - Firewall. Avoid stuffing settings into the Default Domain Policy; keep it to password, lockout and Kerberos policy only.
3. Update the Central Store. Copy the latest Windows 11 / Server ADMX and ADML files, plus SecGuide.admx and LAPS templates, into PolicyDefinitions.
4. Pilot in a test OU. Link to a pilot OU or use security filtering on a pilot group for 1–2 weeks.
5. Use Audit modes where offered. ASR rules, NTLM restrictions and AppLocker all support audit; review the logs before enforcing.
6. Link to production in rings. Workstations first, then member servers, then domain controllers where applicable.
7. Disable unused halves. Turn off the User or Computer configuration section a GPO does not use to speed processing.
8. Document and review. Record the owner, purpose and change date in each GPO’s comment field and review quarterly against the latest Microsoft Security Baseline using Policy Analyzer.

Verification and troubleshooting

Use these commands on a target machine to confirm a GPO applied and its settings took effect.

If a GPO does not apply, check these in order:

• Event log: Applications and Services Logs > Microsoft > Windows > GroupPolicy > Operational shows processing errors.
• Scope: Confirm the computer object is in the linked OU and not blocked by Block Inheritance.
• Security filtering: The target needs Read and Apply group policy; keep Authenticated Users with Read since MS16-072.
• WMI filters: A failing filter silently skips the GPO; test the query with Get-CimInstance.
• Replication: Run repadmin /replsummary and dcdiag /test:sysvolcheck to confirm SYSVOL and AD are in sync.
• Precedence: Remember LSDOU order (Local, Site, Domain, OU); the last applied wins unless a link is Enforced.

References

Recommended values are drawn from general knowledge of these sources and were not re-checked live for this article; confirm against the current versions before enforcing.

• Microsoft Security Compliance Toolkit and Security Baselines (Windows 11, Windows Server 2022/2025), including Policy Analyzer and SecGuide.admx
• CIS Microsoft Windows 11 Enterprise and Windows Server Benchmarks
• Microsoft Learn: Windows LAPS overview and policy settings
• Microsoft Learn: Attack surface reduction rules reference
• Microsoft Learn: Configure Credential Guard and Configure added LSA protection
• Microsoft Learn: Securing privileged access (enterprise access model / tiering)