Group policy
Group policy is a Windows feature that lets an administrator set rules once, such as password length or screen lock, and push them to every computer and user on an Active Directory network. Cyber Essentials does not require it, but it is one way to apply the password quality (A7.11), brute-force (A7.10) and auto-run (A5.8) settings the scheme asks for.
- Term
- Group policy
- Also known as
- Group Policy, GPO, Group Policy Object
- Category
- Accounts and access
- Requirement area
- 4. User Access Control; 2. Secure Configuration
- Reviewed against
- Requirements v3.3
What does the term group policy mean in Cyber Essentials?
Group policy is a Windows feature that lets an administrator set rules once, such as password length or screen lock, and push them to every computer and user on an Active Directory network.
How does group policy apply to Cyber Essentials?
In plain terms
Group policy is like a company handbook that the computers themselves have to follow. Instead of visiting every PC to change a setting, the administrator writes the rule once on the server and every PC on the network picks it up. For devices managed from the cloud instead, Microsoft Intune does a similar job.
What Cyber Essentials asks
The scheme sets outcomes, and group policy is one way to reach several of them on Windows:
- Password quality (A7.11): the NCSC requirements accept a minimum of 12 characters with no maximum, a minimum of 8 with no maximum plus automatic blocking of common passwords using a deny list, or MFA.
- Brute-force protection (A7.10): throttling to no more than 10 guesses in 5 minutes, or locking after no more than 10 unsuccessful attempts, or MFA.
- Auto-run (A5.8): disable any feature that runs files without the user's say-so.
The requirements also say to support users by "not enforcing regular password expiry" and "not enforcing password complexity requirements". Both have their own settings in the Windows password policy.
Common mistakes
- Choosing the 8-character option without a deny list. The basic Windows password policy does not block common passwords on its own, so use 12 characters or add a separate deny list.
- An account lockout threshold above 10, or set to 0, which in Windows means accounts never lock.
- A policy that exists on the server but is not linked to the computers it should cover.
See the Cyber Essentials password rules and the Microsoft Intune setup guide. Related: Active Directory, account lockout, password.
Related terms
- Active Directory (AD)Active Directory is Microsoft's system, run on a Windows server in your own office or data centre, that holds the central list of staff logins, computers and permissions.
- Account lockoutAccount lockout is a setting that blocks further login attempts after a set number of wrong passwords or PINs, so a guesser cannot keep trying.
- PasswordA password is a secret string of characters that you type to prove you are the person an account belongs to.
- Identity provider (IdP)An identity provider is the service that checks who you are when you sign in and then vouches for you to other apps, for example Microsoft Entra ID, Google Workspace or Okta.
- Joiners, movers and leavers (JML)Joiners, movers and leavers is the everyday process of giving new staff the access they need, changing it when they change role, and removing it when they leave.
- Least privilegeLeast privilege is the rule that each person gets only the access they need to do their current job, and nothing more.
Frequently asked questions
Group policy is a Windows feature that lets an administrator set rules once, such as password length or screen lock, and push them to every computer and user on an Active Directory network.
In the 2026 Danzell question set, group policy comes up at A5.8, A7.10, A7.11. Read those questions against the definition above so your answers use the term the way the assessor will.
Group policy relates to 4. User Access Control; 2. Secure Configuration in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.