Windows 2000 Group Policy Filtering by Security Group

This article provides a technical overview of how Microsoft Windows 2000 processes Group Policy filtering through security group memberships. In Windows 2000, Group Policy Objects (GPOs) are linked to Active Directory containers—Sites, Domains, and Organizational Units (OUs)—affecting all users and computers within them by default. However, administrators can precisely control which entities process a policy by modifying the GPO's Access Control Lists (ACLs) based on security group membership, requiring both "Read" and "Apply Group Policy" permissions for successful policy application.

The Default Group Policy Scope

When a GPO is created and linked to an Active Directory container in Windows 2000, it is automatically assigned permissions that grant the Authenticated Users security group both Read and Apply Group Policy (AGP) permissions. Because "Authenticated Users" includes all user accounts and computer accounts within the domain, any object residing in or inheriting from that container processes the GPO by default during startup or user logon.

The Security Filtering Mechanism

Windows 2000 security filtering functions as an access-control mechanism rather than a traditional search filter. During the policy application cycle, the client system evaluates the Discretionary Access Control List (DACL) attached to the GPO in Active Directory (specifically on the groupPolicyContainer object and the associated files in the SYSVOL Policies folder).

For a GPO to be processed by a target account (user or computer), the account must pass a security check against the GPO's DACL that satisfies two distinct access control entries (ACEs):

  1. Read Permission: Allows the client to locate, query, and download the GPO settings from Active Directory and the SYSVOL share.
  2. Apply Group Policy Permission: Explicitly authorizes the operating system's Group Policy client-side extensions (CSEs) to execute and enforce the GPO’s configuration settings on that target.

If either permission is missing, the GPO is bypassed for that account.

How Windows 2000 Evaluates Group Membership

The processing sequence for filtering GPOs by security groups follows these specific operational steps:

  1. Security Token Creation: At computer boot or user logon, Windows 2000 queries the Global Catalog and local Domain Controller to generate a security token. This token contains the Security Identifier (SID) of the object (computer or user) along with the SIDs of all global, domain local, and universal security groups to which the object belongs.
  2. GPO Discovery: The operating system searches the Active Directory hierarchy according to the LSDOU order (Local, Site, Domain, Organizational Unit) to compile a list of all GPOs linked to the object's parent containers.
  3. Security Access Check: For each discovered GPO, the local system compares the SIDs in the object's security token against the GPO's DACL:
    • Explicit or Inherited Deny: If any group present in the security token has a "Deny" ACE for either Read or Apply Group Policy, processing is immediately halted for that GPO. In Windows 2000, "Deny" always takes precedence over "Allow".
    • Allow Check: If no "Deny" exists, the system checks whether the security token contains at least one group (or the object's direct SID) with "Allow" for Read and "Allow" for Apply Group Policy.
  4. Policy Enforcement or Bypass:
    • If both required permissions evaluate to "Allow", the GPO is processed, and its settings are written to the local system or user environment.
    • If the permissions evaluate to false—for example, if the default "Authenticated Users" group is removed and the target object is not a member of any assigned security group—the GPO is silently skipped.

Practical Implementation in Windows 2000

To apply a GPO to a specific security group (e.g., "Finance Department") while excluding the rest of an Organizational Unit:

  • The administrator removes the Apply Group Policy permission from the Authenticated Users group.
  • The administrator adds the "Finance Department" security group to the GPO's DACL and checks the "Allow" box for Apply Group Policy (and ensures Read is granted).
  • Any user who is a member of the "Finance Department" evaluates to true during logon token inspection and processes the policy, while other users within the same OU skip it entirely.