Role of the Group Policy Container in Active Directory

In Microsoft Windows 2000 Active Directory, Group Policy Objects (GPOs) are split into two distinct physical storage components: the Group Policy Template (GPT) and the Group Policy Container (GPC). This article explains the role of the Group Policy Container within Active Directory storage, detailing the metadata it maintains, how it coordinates with file-based policy components, and how directory replication applies to policy deployment.

Definition and Location of the Group Policy Container

The Group Policy Container (GPC) is an Active Directory object that stores high-level GPO attributes and metadata. While the actual settings and script files reside on the file system, the GPC exists directly within the Active Directory database (ntds.dit).

In Windows 2000, GPCs are stored under the System container of the domain naming context. The standard LDAP path is: CN=Policies,CN=System,DC=domain,DC=com

Each individual GPO is represented as a groupPolicyContainer object named after the GPO's unique Globally Unique Identifier (GUID), such as {31B2F340-016D-11D2-945F-00C04FB984F9}.

Core Functions of the GPC

The GPC serves several critical roles in managing and executing policy across the domain:

  • Policy Metadata Storage: The GPC holds essential attributes defining the GPO, including the friendly display name (displayName), creation and modification timestamps, and security descriptors that dictate which users and computers can read or apply the policy.
  • Component Status and Flags: It maintains the flags attribute, which tracks whether the user or computer portions of the GPO are enabled or disabled. This prevents clients from processing inactive policy branches.
  • Client-Side Extension (CSE) Registration: The GPC stores information indicating which Client-Side Extensions are required to process the policy (such as Software Installation, Folder Redirection, or Security Settings) through attributes like gPCUserExtensionNames and gPCMachineExtensionNames.
  • Path Referencing: It stores the UNC path to the corresponding Group Policy Template located in the SYSVOL shared folder via the gPCFileSysPath attribute, enabling client systems to locate the associated registry and script files.

Structural Hierarchy

Within each GPC object, Active Directory creates two structural sub-containers:

  1. CN=Machine: Contains machine-specific metadata, including pointers to software packages assigned or published to computers.
  2. CN=User: Contains user-specific metadata, including pointers to user-assigned software installations.

Replication and Synchronization

Because the GPC is an Active Directory object, it relies entirely on native Active Directory multi-master replication protocols. This separates it from the Group Policy Template, which replicates via the File Replication Service (FRS).

To ensure that both the Active Directory attributes and the SYSVOL files remain in sync, the GPC maintains a versionNumber attribute. This integer is updated each time an administrator modifies the GPO. When a Windows 2000 client processes Group Policy, it compares the GPC version number in Active Directory to the version number recorded in the GPT's gpt.ini file. If the version numbers match, the client processes the policy; if they differ, it indicates replication latency between Active Directory and SYSVOL, and the client may delay application to avoid inconsistent policy enforcement.