Q. Group policy inheritance and application order question

Discussion in 'MCSA' started by Mark Griffiths, Jun 30, 2003.

  1. Group policies are applied in this order: local, site,
    domain, OU (LSDO). OK.
    In AD Users and Computers, the heirarchy looks on the
    screen like the domain is always root, then other 'child'
    objects like OUs. OK

    The question: does the GPO for a domain inherit OU
    settings or does an OU GPO inherit domain GPO settings?

    If the OU inherits GPO from the domain, but the OU setting
    is applied last - there good issue for my brain to explode
    trying to work out how to apply GPO settings.
    Mark Griffiths, Jun 30, 2003
    #1
    1. Advertising

  2. Mark Griffiths

    Lois Guest

    I guess it boils down to: the child object wins (gets it's
    gpo setting applied if conflicting with a gpo in a OU
    higher up) unless there is NO OVERIDE or filtering (no
    READ and APPLY GPO for the child). There is also BLOCK
    POLICY INHERITANCE which does as it states UNLESS there is
    NO OVERIDE which overrules BLOCK POLICY.
    If a higher policy hides something on the desktop, for
    example, and the child hides something else, then the user
    has both things hidden. If the higher GPO hides, and the
    lower GPO SHOWS that same object, in the absence of NO
    OVERIDE the item will be SHOWN.
    It can get complicated, with multiple GPO's at the same
    level being applied; the ones shown higher in the list
    have higher priority and overide those lower in the list.
    Then child OU's apply and "undo" what was done in higher
    GPO's and there can be multiple GPO's there as well. Of
    course, security issues (password policies, for example)
    are applied at the domain level only (the domain is a
    security bounary).
    There is nothing like setting up a lab, creating users and
    groups and DOING this stuff. I spent alot of time on this
    and still learn new things every day about AD. And yes,
    _my_ brain did explode!

    Lois
    MCSA, MCSE

    >-----Original Message-----
    >Group policies are applied in this order: local, site,
    >domain, OU (LSDO). OK.
    >In AD Users and Computers, the heirarchy looks on the
    >screen like the domain is always root, then other 'child'
    >objects like OUs. OK
    >
    >The question: does the GPO for a domain inherit OU
    >settings or does an OU GPO inherit domain GPO settings?
    >
    >If the OU inherits GPO from the domain, but the OU

    setting
    >is applied last - there good issue for my brain to

    explode
    >trying to work out how to apply GPO settings.
    >
    >
    >
    >
    >.
    >
    Lois, Jul 5, 2003
    #2
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Victor

    Clear Style Inheritance

    Victor, Dec 18, 2005, in forum: Firefox
    Replies:
    0
    Views:
    526
    Victor
    Dec 18, 2005
  2. Tyler Cobb
    Replies:
    6
    Views:
    18,538
    Tyler Cobb
    Oct 19, 2005
  3. =?Utf-8?B?UGhvZW5peCBDeWNsaXN0?=

    Group policy with no group

    =?Utf-8?B?UGhvZW5peCBDeWNsaXN0?=, Mar 15, 2007, in forum: Wireless Networking
    Replies:
    1
    Views:
    491
    Jack \(MVP-Networking\).
    Mar 15, 2007
  4. crazyj

    Need Inheritance Java Help Please!

    crazyj, Oct 27, 2007, in forum: General Computer Support
    Replies:
    1
    Views:
    676
    iman246105
    Oct 30, 2007
  5. djpimpdaddy
    Replies:
    0
    Views:
    587
    djpimpdaddy
    Jul 9, 2007
Loading...

Share This Page