GPO policy settings which trumps which?

Posted on 2009-04-30
Medium Priority
Last Modified: 2013-11-21
Hey Experts,
Quick question regarding the GPO tree.  If, for example, I have a OU tree with the following policies, which one beats out the other?

   |_domain policy
   |____Users (OU)
                    |__another domain policy

To further the example for clarification, if I set the idle time for a TS session under the "domain policy" to be 10 minutes, and then go to the "another domain policy" and I want that OU group to have a different idle time of 20 minutes, is it safe to say that the policy most closely linked to the OU will win out with the users in that group having 20 minutes?  Or will the "domain policy" trump the "another domain policy"?

I'm assuming that the "another domain policy" is the last and final policy applied after the "domain policy".  Am I correct?
Question by:andlemir

Expert Comment

ID: 24273664
the policies will work backwards, and apply the parent unless you disable that feature then you can ignore the parent policy

Accepted Solution

ISWSIMBX earned 1200 total points
ID: 24273693
Group Policies apply from the top down.  So for example, a policy that has specific settings that is linked to the domain can be overriden by a policy linked to an OU with a different value for that specific setting.
LVL 57

Assisted Solution

by:Mike Kline
Mike Kline earned 800 total points
ID: 24273722
The acronym you will want to remember is LSDOU...I've also heard that term used in tech interviews
GPOs, once created, are applied in a standard order: LSDOU, which stands for (1) Local, (2) Site, (3) Domain, (4) OU, with the later policies being superior to the earlier applied policies.

Author Closing Comment

ID: 31576622
Thank you experts!  I will keep the LSDOU in mind from now on.  Thanks ISW and MKL

Featured Post

Free Tool: Site Down Detector

Helpful to verify reports of your own downtime, or to double check a downed website you are trying to access.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Had a business requirement to store the mobile number in an environmental variable. This is just a quick article on how this was done.
Transferring FSMO roles is done when an admin wants to split roles between certain Domain Controllers or the Domain Controller holding the Roles has been forcefully demoted using dcpromo / forceremoval
This video shows how to use Hyena, from SystemTools Software, to bulk import 100 user accounts from an external text file. View in 1080p for best video quality.
There are cases when e.g. an IT administrator wants to have full access and view into selected mailboxes on Exchange server, directly from his own email account in Outlook or Outlook Web Access. This proves useful when for example administrator want…
Suggested Courses

809 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question