|
Home > Archive > 70-217 > February 2002 > GPO question
You are viewing an archived Text-only version of the thread.
To view this thread in it's original format and/or if you want to reply to
this thread please [click here]
|
|
| Piranha 2002-01-13, 12:05 pm |
| I am not sure if I understand the Inheritance stuff properly. I want to apply a GPO on the OU level. Where do I have to specify which GPO takes precedence? At the domain level (by using "Block Policy Inheritance") or at the OU level ("Block Policy Inheritance").
Thanks for your help in advance!
Piranha | |
| safouh 2002-01-14, 9:49 am |
| Hi ,
GPO sequence is :
Local GPO --> Site GPO --> Domain GPO --> OU GPO
so normally Domain level GPO take higher priority than OU GPO , I hope this answer your question ...
Cheers , | |
| Piranha 2002-01-14, 9:53 am |
| Hi,
Actually - what I meant is
I create GPO for the domain. I will then create the GPO for an OU to have special security settings changed. Will the GPO at the OU level be overwritten by the domain GPO and if so - where will I need to specify the "No overwrite"?
Sorry, I am getting a little bit confused with this.
Thanks!
Piranha | |
| netboy21 2002-01-16, 10:41 am |
| You can only specify No Override at the domain level, Block policy inheritance is set at the OU level to block other GPO's from being applied. Remember though, if the no override option is applied at the domain level, the GPO's at lower levels wont even be applied. Also remember that GPO's are processed from the bottom up in the list of GPO's linked to either the Domain, Site or OU. So the GPO placed on top of the list will be processed last and thus given the highest priority. Hope this helps | |
| alainpf 2002-01-19, 3:08 am |
| You don't need to do anything more in the case you submit: the GPO at the OU level will overwrite the GPO at the domain level, in case some parameters are in conflict, as it is applied after.
Another case: if, at the OU level, you don't want any of the doamin GPO parameters to be applied, then you have to check *block inheritance*
Another case: if you don(t want your domain GPO to be altered by OU's GPO, then you have to check *don't override* at the domain level, which means that thes e domain polciy settings will NOT be overwritten by ou's policy settings.
Hope it helps
On the other hand, if you don't want | |
| Piranha 2002-01-19, 10:47 am |
| Well, I think I got it now! You guys are awesome! Thanks!
Piranha | |
|
| If you apply a gpo at the domain level with no overide, conflicting settings can't override at lower levels. The OU GPOs will apply if the settings are unique and do not conflict. |
|
|
|
|