GPO

A Windows mechanism for centrally configuring users and computers in a domain.

A GPO is the Windows mechanism for centrally defining and enforcing configuration settings for users and computers across an Active Directory domain. It lets administrators apply consistent security baselines such as password policies, software restrictions, and account lockout rules at scale, supporting hardening and compliance. Policies apply in a defined order from local to site to domain to organizational unit, with later levels generally overriding earlier ones. The exam relevance is recognizing GPOs as a key tool for standardized, enforceable endpoint configuration and least privilege in domain environments.