Group Policy Objects (GPOs) enforce configuration settings on AD-joined Windows systems — password policies, screen lock, USB restrictions, firewall rules, software deployment.
GPO processing order: Local → Site → Domain → OU (LSDOU). Last applied wins. Essential enterprise hardening tool. Auditing GPO changes is critical — a malicious GPO can deploy malware to all domain computers.