AZ-800 Exam Alignment
AZ-800

Configure and manage Group Policy: Create and link GPOs, understand inheritance, enforcement, and blocking, configure security and WMI filtering, deploy ADMX templates, and troubleshoot GPO application with gpresult and RSoP.

• Know the GPO processing order: Local → Site → Domain → OU (LSDOU), with later settings overwriting earlier ones
• Understand the difference between Enforced (No Override) and Block Inheritance — Enforced always wins
• Know how Security Filtering restricts which users/computers a GPO applies to
• Understand that gpupdate /force triggers immediate policy application without waiting for the background refresh interval

Exam Tip: AZ-800 frequently tests GPO application troubleshooting. Know that gpresult /r shows which GPOs were applied to the current user/computer. Know that Security Filtering removes the Authenticated Users group and replaces it with specific targets, which also requires the target to have Read permission on the GPO (not just Apply).

🌐 GPO Creation and Linking

A Group Policy Object (GPO) is a collection of settings stored in the domain’s SYSVOL share and applied to users and computers. GPOs must be linked to a site, domain, or OU to take effect.

Group Policy Management Console
|
techcareers.local

🏝️ Forest: techcareers.local

🌎 techcareers.local

📄 Default Domain Policy

📁 London

📄 TC-Desktop-Settings

📄 TC-Password-Policy-HR

📁 Domain Controllers

📄 Default Domain Controllers Policy

TC-Password-Policy-HR — Scope

Links: London → HR OU

Security Filtering: TC-HR-Users (replaces Authenticated Users)

Status: Enabled (Computer & User settings)

WMI Filter: None

ⓘ When Security Filtering is applied, both Read and Apply Group Policy permissions must be set on the target group. Remove Authenticated Users only after confirming this.

📅 GPO Processing Order and Inheritance

🔌 Filtering GPO Application

# Create a new GPO
New-GPO -Name 'TC-Desktop-Settings' -Comment 'Enforces corporate desktop settings'

# Link the GPO to an OU
New-GPLink -Name 'TC-Desktop-Settings' -Target 'OU=London,DC=techcareers,DC=local' -LinkEnabled Yes

# Enforce a GPO (No Override) on a specific link
Set-GPLink -Name 'TC-Desktop-Settings' -Target 'OU=London,DC=techcareers,DC=local' -Enforced Yes

# Block GPO inheritance on a child OU
Set-GPInheritance -Target 'OU=IT,OU=London,DC=techcareers,DC=local' -IsBlocked Yes

# View GPO inheritance and applied GPOs for an OU
Get-GPInheritance -Target 'OU=London,DC=techcareers,DC=local'

# Force immediate policy refresh remotely
Invoke-GPUpdate -Computer 'PC01' -Force

# Troubleshoot: show applied GPOs for current user/computer
gpresult /r

# Generate full HTML RSoP report
gpresult /h C:\GPReport.html /user techcareers\jsmith /scope user

💡 Best Practices

• Never edit the Default Domain Policy or Default Domain Controllers Policy — create new GPOs for all custom settings so you can revert changes without affecting baseline security
• Name GPOs descriptively: TC-[Location/Department]-[Function] (e.g. TC-London-DesktopLockout) — avoid generic names like “New GPO”
• Keep GPOs focused on a single purpose — one GPO per setting category (software, security, drive maps) makes troubleshooting and rollback easier
• Use gpresult /r or gpresult /h as your first troubleshooting step when users report that a policy isn’t applying
• Store ADMX templates in the Central Store (\\domain\SYSVOL\domain\Policies\PolicyDefinitions) so all admins see the same templates
• Use Security Filtering in preference to WMI Filters — WMI filters are evaluated on the client, adding CPU overhead and making GPO application slower

🎓 Interview Q&A