GPO process

Processing a GP steps by step procedure:

1. The client performs Internet Control Message Protocol (ICMP) slow-link detection to a domain controller in its site to determine link speed. In Windows Vista, the use of ICMP for slow-link detection is replaced by the Network Location Awareness (NLA) service.
2. The client reads CSE status information from its local registry to determine which GPOs were processed last.
3. The client uses LDAP to search the gpLink attribute in Active Directory on each container object within its location in the Active Directory hierarchy—first at the OU level (including all nested OUs), then at the domain, and finally at the Active Directory site level. From the results of this search, it builds a list of GPOs that must be evaluated for processing.
4. Each GPO is then searched in Active Directory to determine whether the client (user or computer) has the necessary permissions to process it. Its version number, the path to the Group Policy Template (GPT) portion of the GPO in SYSVOL, and what CSEs are implemented in that GPO are also evaluated.
5. The client then uses the Server Message Block (SMB) protocol to read the contents of the GPT and get the GPO's version number from the gpt.ini file. The version numbers in the Group Policy Container (GPC) and GPT are one factor that is used to determine whether a GPO has changed since the last processing cycle.
6. Each CSE runs in the order that is registered under HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions, and processes the GPOs that implement that CSE if the GPO has changed since last processing cycle (as determined during core processing). Each CSE also logs Resultant Set of User Policy (RSOP) data to Windows Management Instrumentation (WMI) during each refresh, if available.

https://docs.microsoft.com/en-us/previous-versions/technet-magazine/cc137720(v=msdn.10)

1. The workstation queries a DNS server to locate a DC in the workstation's site. To be precise, the workstation queries DNS for the _ldap._tcp.sitename._sites.dc._msdcs.domain-name SRV record. This record returns the name of the DC (in the site sitename) that handles Lightweight Directory Access Protocol (LDAP) requests for the domain.
2. The workstation establishes a secure-channel connection with the DC.
3. The workstation pings the DC to determine whether the workstation's network connection to the DC (e.g., dial-up, T1) constitutes a slow network link. (By default, Win2K considers a transfer rate of less than 500Kbps to be slow. See the Microsoft article "How a Slow Link Is Detected for Processing User Profiles and Group Policy" at http://support.microsoft.com/default.aspx?scid=kb;en-us;q227260 for information about how Win2K calculates slow links.)
4. The workstation binds to AD over LDAP.
5. The workstation uses LDAP to query AD and get a list of all the GPOs linked to the workstation's OU or parent OU.
6. The workstation uses LDAP to query AD and get a list of all the GPOs linked to the workstation's domain.
7. The workstation uses LDAP to query AD and get a list of all the GPOs linked to the workstation's site.
8. The workstation uses LDAP to query the GPC (in AD) and determine the path to each GPO's GPT (in Sysvol).
9. The workstation reads the gpt.ini file that resides in each GPO's GPT. This file lists the GPO's current version number.
10. The workstation's client-side extensions process the retrieved GPOs.