Group Policy traffic (1/2)

• Group Policy

  • GPO (machine settings) are processed when a domain member server starts
  • GPO (user settings) are processed when a domain user logs on a domain member server
  • GPO are then frequently refreshed

• Group Policy in Active Directory

  • Linked GPO are stored in Active Directory
    • LDAP unencrypted queries (gPLink and gPOptions attributes) to determine linked GPO (site-level GPOs, domain-level GPOs, OU-level GPOs)
    • ethereal display filter: ldap.attribute = "gPLink"
    • gPLink contains the DN where the GPO is defined in AD
    • Additional LDAP query for several attributes of returned DN entry, including gPCFileSysPath