Group Policy

Posted on 2004-11-21
Last Modified: 2010-04-14
Hi, need some clarity on group policy. So far, what I've gathered:

1. Things defined in DOMAIN SECURITY POLICY take precedence over any GPOs defined at the OU level.   You cannot block any settings defined in DOMAIN SECURITY POLICY

2. OU policy will take precedence over anything defined in DEFAULT DOMAIN POLICY

Now my question:
If you leave a setting undefined at the OU level. But have it defined in the DEFAULT DOMAIN POLICY, which will take precedence?

It seems to me that it is easier to just remove the DEFAULT DOMAIN POLICY ,and add policy to specific GPOs instead.  Less troubleshooting.

Question by:dissolved
    LVL 8

    Accepted Solution

    1. There are some things you cannot set in the GPO, they can only be set in the domain security policy eg password length, for the whole domain you would have a policy with the same password length

    2. The order is Local Policy->Domain->Site->OU
    for example if you have two setting which are the same, one in domain policy and one in OU, then the OU with take precendence.
    This is true unless you use No Override (Block inheritance) at the domain level, then the domain policy with take effect.

    Regarding your question, if you leave it undefined on OU, the the domain policy with take precedence.
    LVL 11

    Assisted Solution

    1) you can block the default domain policy as any other policy, execpt the security policies anil_u talked about.
    2) anil_u is right here too, but if you switch on "loopback processing" any computer policy will aply it's user settings AFTER any other user policy :)

    Author Comment

    The order of policies is= Local Policy --->  Domain ---->  Site --->   OU            Right?

    -What is "site"?  Can someone elaborate?  And I'm assuming  policies undefined at the domain level, But defined at the local level , will have the local level take precedence?

    -What is loopback processing and is it widely used?

    Thanks fellas
    LVL 6

    Assisted Solution

    LVL 11

    Expert Comment

    > -What is "site"?  
    Open AD Sites and Services to see your sites.
    A site is a location with computers which are connected to each other by a LAN or fast WAN.

    Loopback processing: If you link a policy to a computer, the user section would be overruled by any user policy.
           to reprocess this user section of the computer linked policy, loopback processing is used.

    Author Comment


    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    Enabling OSINT in Activity Based Intelligence

    Activity based intelligence (ABI) requires access to all available sources of data. Recorded Future allows analysts to observe structured data on the open, deep, and dark web.

    NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
    Digital marketing agencies have encountered both the opportunities and difficulties that emerge from working with a wide-ranging organizations.
    In this seventh video of the Xpdf series, we discuss and demonstrate the PDFfonts utility, which lists all the fonts used in a PDF file. It does this via a command line interface, making it suitable for use in programs, scripts, batch files — any pl…
    Access reports are powerful and flexible. Learn how to create a query and then a grouped report using the wizard. Modify the report design after the wizard is done to make it look better. There will be another video to explain how to put the final p…

    759 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    13 Experts available now in Live!

    Get 1:1 Help Now