Group policy lets you basically configure anything on any machine in the active directory domain; Installed programs, installed updates, basically any settings, schedules, services, automatically adding (and limiting by users if you want) network devices like printers and storage… It’s pretty powerful, and does way more than just filesystem permissions.