Some of the differences between policies and preferences include the following:
A policy disables its associated user interface item on the user’s computer; a preference does not.
- A policy is removed when the GPO goes out of scope—that is, when the user or computer is no longer targeted by the GPO. A preference, however, remains configured for the targeted user or computer even when the GPO goes out of scope. Another way of saying this is that preferences tattoo the registry on the client computer, while policies do not tattoo the registry on the client computer.
When a policy is applied, the original registry settings on the client computer are not changed. Instead, the policy is stored in a special policy-aware section of the registry on the client. If the policy is later removed, the client’s original registry settings are restored. Another way of saying this is that a policy supersedes the corresponding configuration setting in the user interface on the client. With preferences, however, the original registry settings on the client are overwritten and removing the preference does not restore the original setting. In other words, a preference actually modifies the corresponding configuration setting in the user interface on the client. Because of this difference, policies can be effective only for features of Windows operating systems and applications that are Group Policy–aware, while preferences can be effective for any features of Windows operating systems and applications as long as the appropriate preference extension is loaded.
Policies can be configured in both domain and local GPOs; preferences can be configured only in domain GPOs.
A preference can be applied only once if desired; policies are always periodically refreshed.
The above tip was excerpted from Mitch Tulloch’s book Training Guide: Installing and Configuring Windows Server 2012 from Microsoft Press.
Mitch is a nine-time recipient of the Microsoft Most Valuable Professional (MVP) award and a widely recognized expert on Windows administration, deployment and virtualization. For more information see http://www.mtit.com.