Computer vs User Configuration in Windows 2000 GPO
In Microsoft Windows 2000, Group Policy Objects (GPOs) are divided into two primary sections: Computer Configuration and User Configuration. This article explains the core differences between these two policy branches, focusing on their scope of application, execution timing, and registry impact, helping administrators understand how settings are enforced across an Active Directory environment.
Computer Configuration
Computer Configuration defines policies that apply specifically to the physical or virtual workstation or server, regardless of which user logs onto the machine.
- Application Timing: These policies are applied when the operating system boots up, before the logon dialog box appears, and during periodic background refreshes (typically every 90 minutes with a randomized 30-minute offset).
- Scope of Settings: It governs system-level behavior, including operating system settings, local security policies, startup and shutdown scripts, hardware profiles, network configuration, and system services. Software deployed under this node is assigned to the computer and installed before any user logs in.
- Registry Target: Settings applied via Computer
Configuration primarily write to the
HKEY_LOCAL_MACHINE(HKLM) registry hive.
User Configuration
User Configuration defines policies that apply to specific user accounts, following the user regardless of which computer they log into within the domain.
- Application Timing: These policies are processed after the user enters their credentials at the logon prompt, as well as during periodic background refreshes while the user remains logged in.
- Scope of Settings: It controls the personalized computing experience, such as the desktop appearance, Start menu options, screen savers, user logon and logoff scripts, and folder redirection (e.g., redirecting the "My Documents" folder to a network share). Software deployed here can be published or assigned directly to the individual user.
- Registry Target: Settings applied via User
Configuration write to the
HKEY_CURRENT_USER(HKCU) registry hive.
Key Differences at a Glance
| Feature | Computer Configuration | User Configuration |
|---|---|---|
| Target Object | Active Directory Computer accounts | Active Directory User accounts |
| Execution Point | System boot and shutdown | User logon and logoff |
| Registry Hive | HKEY_LOCAL_MACHINE |
HKEY_CURRENT_USER |
| Software Deployment | Assigned only (mandatory install) | Assigned or Published (optional install) |
| Typical Use | System security, services, hardware | Desktop UI, personal preferences, user data |
Loopback Processing
While Computer and User configurations normally function independently based on the targeted Active Directory object, Windows 2000 introduces Group Policy Loopback Processing. This advanced setting allows administrators to apply a specific set of User Configuration settings based on the computer the user logs into, rather than the user's standard policy. This is commonly implemented in shared environments, such as public kiosks, classrooms, or Terminal Services servers, where a consistent user experience must be enforced regardless of who logs in.