Documentation forAccess Rights Manager

Create, edit, enable or disable, and delete GPOs

In the ARM web client, you can manage the lifecycle of Group Policy Objects (GPOs) in your scanned Active Directory domains.

To perform these tasks, you need an ARM role with write access in the web client and membership in Domain Admins, Enterprise Admins, Group Policy Creator Owners, or BUILTIN\Administrators in the target domain. See Group Policy Objects (GPOs) in the web client for prerequisites and for the credentials that ARM uses.

These actions change your production Active Directory and the SYSVOL share of the domain. Changes apply to the users and computers in the linked OUs at the next Group Policy refresh.

Create a GPO

New GPOs are created empty, without policy settings. To add policy settings, edit the GPO after you create it.

  1. In the web client main menu, click GPO.

  2. Click the domain in which you want to create the GPO.

  3. Click Create New GPO.

  4. Enter a display name for the GPO.

  5. (Optional) Select the OUs to link the GPO to. See Link a GPO to organizational units.

  6. Click Create to save the new GPO.

ARM creates the GPO in Active Directory, creates its folder structure in SYSVOL, and adds the GPO to the ARM data so it is displayed immediately.

Edit a GPO

You can change the display name, the status, the policy settings, and the OU links of a GPO.

  1. In the web client main menu, click GPO, and then click the domain.

  2. Select the GPO and click Edit.

  3. Make your changes:

  4. Save your changes.

When you save, ARM updates the GPO in Active Directory and SYSVOL and increases the GPO version number.

Enable or disable a GPO

The status of a GPO determines whether its user settings and computer settings are applied. You can set one of the following statuses:

Status flag Meaning
0 All settings enabled
1 User settings disabled
2 Computer settings disabled
3 All settings disabled

  1. In the web client main menu, click GPO, and then click the domain.

  2. Select the GPO and click Edit.

  3. Select the status, and save your changes.

Delete GPOs

You can delete one or more GPOs at a time. ARM deletes each GPO from Active Directory and from the ARM data.

Deleting a GPO cannot be undone from ARM. The settings of the GPO are no longer applied to the linked OUs.

  1. In the web client main menu, click GPO, and then click the domain.

  2. Select the GPOs that you want to delete.

  3. Click Delete and confirm the deletion.

ARM displays the result for each GPO. If some GPOs cannot be deleted, the other GPOs are still deleted. Review the results to identify the GPOs that failed and the reason.