I am not sure if I understand the Inheritance stuff properly. I want to apply a GPO on the OU level. Where do I have to specify which GPO takes precedence? At the domain level (by using "Block Policy Inheritance") or at the OU level ("Block Policy Inheritance").

Thanks for your help in advance!

Piranha

__________________
September 11, 2001
We will never forget!
United We Stand!

Report this post to a moderator

Hi ,

GPO sequence is :

Local GPO --> Site GPO --> Domain GPO --> OU GPO

so normally Domain level GPO take higher priority than OU GPO , I hope this answer your question ...

Cheers ,

Report this post to a moderator

Hi,

Actually - what I meant is

I create GPO for the domain. I will then create the GPO for an OU to have special security settings changed. Will the GPO at the OU level be overwritten by the domain GPO and if so - where will I need to specify the "No overwrite"?

Sorry, I am getting a little bit confused with this.

Thanks!

Piranha

__________________
September 11, 2001
We will never forget!
United We Stand!

Report this post to a moderator

You can only specify No Override at the domain level, Block policy inheritance is set at the OU level to block other GPO's from being applied. Remember though, if the no override option is applied at the domain level, the GPO's at lower levels wont even be applied. Also remember that GPO's are processed from the bottom up in the list of GPO's linked to either the Domain, Site or OU. So the GPO placed on top of the list will be processed last and thus given the highest priority. Hope this helps

Report this post to a moderator

You don't need to do anything more in the case you submit: the GPO at the OU level will overwrite the GPO at the domain level, in case some parameters are in conflict, as it is applied after.
Another case: if, at the OU level, you don't want any of the doamin GPO parameters to be applied, then you have to check *block inheritance*
Another case: if you don(t want your domain GPO to be altered by OU's GPO, then you have to check *don't override* at the domain level, which means that thes e domain polciy settings will NOT be overwritten by ou's policy settings.
Hope it helps

On the other hand, if you don't want

Report this post to a moderator

Well, I think I got it now! You guys are awesome! Thanks!

Piranha

__________________
September 11, 2001
We will never forget!
United We Stand!

Report this post to a moderator

If you apply a gpo at the domain level with no overide, conflicting settings can't override at lower levels. The OU GPOs will apply if the settings are unique and do not conflict.

Report this post to a moderator