## Group Policy (GPO)

Group Policy Objects allows Admins to push settings to thousands of computers at once.
*   "Disable Control Panel for all HR employees."
*   "Set the wallpaper to company logo."
*   "Install Chrome on all computers."

### Structure
*   **Computer Configuration**: Applies to the machine (starts at boot).
*   **User Configuration**: Applies to the user (starts at login).

### The Refresh
GPO is not instant.
*   `gpupdate /force`: Command to force a sync with the DC.
*   Refreshes every 90 minutes by default.

### Abuse
If a hacker compromises a Domain Admin account, they can create a malicious GPO to deploy Ransomware to every PC in the company instantly. This is how massive breaches happen.