Active Directory handles logins. Group Policy (GPO) is what actually enforces rules across every machine on the domain — restricted folders, blocked USB ports, forced password complexity, and dozens of other settings pushed out from one place instead of configured device by device.
What GPO can restrict or control
- Folder access — restrict who can open, edit, or even see a shared folder, department by department (HR, Finance, Sales each get only what they need)
- USB and removable media — block USB drives entirely, or allow read-only, to stop uncontrolled data walking out the door
- Password rules — minimum length, complexity, expiry, and lockout after failed attempts, applied domain-wide
- Software restrictions — block specific applications from running, or restrict install permissions so users can't install random software
- Desktop and login behavior — auto-lock after inactivity, disable Control Panel access for regular staff, force a specific login screen
- Drive mapping — automatically connect each department to its correct shared drive at login, no manual setup per machine
Restricted folders in practice
On an 80-user deployment, I set up GPO policies so each department's shared drive was only visible to that department — Finance couldn't browse HR's folder, and vice versa, without anyone needing to remember a password for a separate drive. This is done through NTFS permissions combined with GPO-pushed drive mappings, not through hiding folders and hoping nobody looks.
Separately, I've also handled this at the file-server level for a client — folder-level access control on a NAS, organized by department, so the restriction lives at the storage layer even where a full GPO/AD setup wasn't in place yet.
Where GPO misconfiguration causes real problems
Common mistakes: conflicting policies at different levels (site, domain, OU) that fight each other with unpredictable results; forgetting that GPO changes take time to propagate (a "gpupdate /force" on the client machine speeds this up); and restricting something without checking whether a legitimate business process depends on it — like blocking USB and then finding out the accounts team needs it for bank file transfers.
Bottom line
If AD is the guest list, GPO is the set of house rules that apply once someone's inside. For any office where sensitive data (financial, HR, client) sits on a shared drive, restricted folders through GPO are one of the highest-value, lowest-cost security steps available — most of the setup is a few hours of configuration, not new hardware or software licenses.