Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 246
  • Last Modified:

Question on GPOs

Hi All

We are running Windows 2003 functional level AD.

I have an OU - kam.com\UK\Test Servers

This has two GPO's applied to it - GPO1 and GPO2.

If I look at the OU in GPMC, then the link order is:

1. GPO1
2. GPO2

Both are set to Enforced = No
Link Enabled = No

Couple of questions;

a) I assume this means the order the GPO will be applied in is GPO1 and then GPO2? If there is a conflicting setting, which one takes precedence?

b) What do ENFORCED and LINK ENABLED mean in this instance?

Any help appreciated!

0
kam_uk
Asked:
kam_uk
  • 3
  • 2
2 Solutions
 
Mike KlineCommented:
a)  GPO2 will be applied first then GPO1, it goes from bottom to top in GPMC.  GPO1 will take precedence.   Another good way to see what policies are set is to run an RSoP report from Group Policy Management Console (GPMC)
 
b)  Enforced means that the policy at the lower level won't win. (it won't be overwritten) So lets say you had a domain level group policy with "enforced"  That policy will win.  In the old days this setting was reffered to as "no override"
http://technet.microsoft.com/en-us/library/cc978255.aspx
Link enabled means that the Group Policy is linked to the OU.  So the policy will apply to that OU if link enabled is set.  If it is not set like what you have then it won't apply the objects in that OU.
 
THanks
Mike


0
 
kam_ukAuthor Commented:
Hi Mike,

Thanks for answeing...I have enabled by GPO's! :)

Out of interest, what would be the advantage of setting 'No' to link enabled?

Thank
0
 
Ron MalmsteadInformation Services ManagerCommented:
mkline is correct...
http://technet.microsoft.com/en-us/library/cc757050.aspx#BKMK_block

just want to add one more thing...

There are also LOCAL, SITE, and DOMAIN policy objects.  Each policy as it is applied overrides the previous policy unless the previous policy is set to "enforced".  If both are set to enforced, then conclicting policy will be overrided by the policy applied last.  You can also "block inheirtance"... which would mean that a domain policy wouldn't be inherited downlevel on a particular OU unless it was set to enforced.

Here is the order in which policies are applied..
Local policy
Site Policy
Domain Policy
OU Policy

If an OU policy is set to ENFORCED, it will override previous conflicting policy settings...including a domain policy that is set to enforced.
0
Simplify Active Directory Administration

Administration of Active Directory does not have to be hard.  Too often what should be a simple task is made more difficult than it needs to be.The solution?  Hyena from SystemTools Software.  With ease-of-use as well as powerful importing and bulk updating capabilities.

 
Mike KlineCommented:
Good point XuserX
...LSDOU is also a really good thing to remember for interviews :)
0
 
Mike KlineCommented:
So here is an example where I set link enabled to "no"
We wanted to delete a bunch of GPO's before deletion I first set link enable to no for a few days just to be positive removing the GPO would be ok.
...usually we don't use it though.
Thanks
Mike
0
 
Ron MalmsteadInformation Services ManagerCommented:
Here's an example of having a GPO link disabled.

I actually have a GPO object that I use in "emergency" situations...for example.. If my entire network was infected with a virus... I apply the GPO which puts a whole bunch of security restrictions on the pc's and has logon/logoff scripts that run a command line virus scanner...it locks down everthing.  Of course this policy is link disabled,..and I would only apply it in an emergency situation where I want to hinder the spread of a virus quickly.  Once my policy is enabled, I run a script on remote machines that runs... GPUPDATE /FORCE so that the policy is applied immediately without waiting for gp refresh.
0

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

  • 3
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now