• Introduction
• Features
• Architecture
• Installation
• Usage
• Plugin Development
• Contributing
• License

GPOA (GPO Applier for Linux) is a comprehensive facility to fetch, reinterpret and apply Group Policy Objects (GPOs) from Windows Active Directory domains in Linux environments. Developed by ALT Linux team, it enables seamless integration of Linux machines into corporate Windows infrastructure.

• Multi-backend Support: Samba, FreeIPA, and no-domain backends
• Policy Types: Registry settings, files, folders, environment variables, scripts, services, and more
• Display Manager Integration: LightDM, GDM with background and theme support
• Plugin System: Extensible architecture for custom policy types
• Privilege Separation: Secure execution with proper privilege contexts

• System Configuration: Environment variables, services
• Desktop Settings: GSettings, KDE configuration, browser policies
• Security: Polkit policies
• Network: Network shares
• Applications: Firefox, Chrome, Thunderbird, Yandex Browser
• Files and Folders: File deployment, folder redirection

• Samba Backend: Traditional Active Directory integration
• FreeIPA Backend: Enhanced FreeIPA/IdM integration
• No-domain Backend: Local policy application

• Policy Appliers: Specialized modules for different policy types
• Plugin Framework: Extensible plugin system with logging and translations

• Machine Context: Root-privileged system-wide changes
• User Context: User-specific configuration application
• Message Codes: Structured logging with translation support
• Registry Access: Secure access to policy registry data

# Clone the repository git clone https://github.com/altlinux/gpupdate.git cd gpupdate # Build RPM package rpmbuild -ba gpupdate.spec # Install the package rpm -ivh ~/rpmbuild/RPMS/noarch/gpupdate-*.rpm

• Python 3.6+
• Samba client tools
• FreeIPA client (optional)
• Systemd
• D-Bus

# Run as root for system-wide policies sudo gpoa

# Run as root for user-specific policies sudo gpoa username

# Can be run as regular user gpupdate --force

Plugins are automatically discovered from:

• /usr/lib/gpupdate/plugins/ (system plugins)
• gpoa/frontend_plugins/ (development plugins)

GPOA features a comprehensive plugin system. See documentation for detailed information:

• PLUGIN_DEVELOPMENT_GUIDE.md - English version
• PLUGIN_DEVELOPMENT_GUIDE_RU.md - Russian version

Documentation covers:

• Plugin architecture and API
• Creating custom plugins
• Logging and message codes
• Translation support
• Best practices

fromgpoa.plugin.plugin_baseimportFrontendPluginclassMyPlugin(FrontendPlugin): domain='my_plugin'def__init__(self, dict_dconf_db, username=None, fs_file_cache=None): super().__init__(dict_dconf_db, username, fs_file_cache) self._init_plugin_log(message_dict={'i':{1: "Plugin initialized"}, 'e':{1: "Plugin failed"} }, domain="my_plugin") defrun(self): self.log("I1") returnTruedefcreate_machine_applier(dict_dconf_db, username=None, fs_file_cache=None): returnMyPlugin(dict_dconf_db, username, fs_file_cache)

The main communication channel for GPOA is Samba@ALT Linux mailing lists. The mailing list is in Russian but you may also send e-mail in English or German.

GPOA - GPO Applier for Linux

Copyright (C) 2019-2025 BaseALT Ltd.

This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program. If not, see http://www.gnu.org/licenses/.