GPO behavior
Group Policy is processed
in the following order:
Local Policy > Site GPO >
Domain GPO > OU GPO > Child OU GPO
and so on.
GPOs inherited from the
Active Directory are always stronger
than local policy. When you configure a
Site policy it is being overridden by
Domain policy, and Domain policy is
being overridden by OU policy. If there
is an OU under the previous OU, its GPO
is stronger the previous one.
The rule is simple, as
more you get closer to the object that
is being configured, the GPO is
stronger.
What does it mean
"stronger"? If you configure a GPO and
linke it to "Organization" OU, and in it
you configure Printer installation –
allowed and then at the "Dallas" OU you
configured other GPO but do not allow
printer installation, then the Dallas
GPO is more powerful and the computers
in it will not allow installation of
printers.
The example above is true
when you have different GPOs that have
similar configuration, configured with
opposite settings. When you apply couple
of GPOs at different levels and every
GPO has its own settings, all settings
from all GPOs are merged and inherited
by the computers or users. |
