GPO and OU flow

Toggle sidebar Toggle sidebar
R

ricardo

Distinguished
Apr 11, 2004
130
0
18,680
Archived from groups: microsoft.public.win2000.active_directory (More info?)

In a OU a have 4 GPOs linked.
Which one will be applyed first ? The one in the top or the last one ?
 
G

Guest

Guest
Archived from groups: microsoft.public.win2000.active_directory (More info?)

Another very good basic question! Actually, these types of questions are
very helpful for a lot of people learning!

If you are using the Active Directory Users and Computers MMC and you right
click on an OU and select Properties and then click on the Policy tab you
will see the four GPOs. First, the one on the bottom is processes. Then,
the one directly above that is processed. Then, the one above that and
finally the one listed at the top is processed. So, it starts at the bottom
and finishes at the top!

Should there be something common in multiple GPOs then the last one
processed wins! So, if there was something common with the GPO listed at
the bottom and the GPO listed at the top the setting from the GPO listed at
the top would win ( as it is processed last ).

--
Cary W. Shultz
Roanoke, VA 24012
Microsoft Active Directory MVP

http://www.activedirectory-win2000.com
http://www.grouppolicy-win2000.com



"Ricardo" <Ricardo@discussions.microsoft.com> wrote in message
news:35928B5A-ED1F-48D9-A7D1-194F56DB2ED2@microsoft.com...
> In a OU a have 4 GPOs linked.
> Which one will be applyed first ? The one in the top or the last one ?
 
G

Guest

Guest
Archived from groups: microsoft.public.win2000.active_directory (More info?)

And to add some more info on GPOs :)
The processing order of GPOs are:

1. Local
2. Site
3. Domain
4. OU

This means that the setting that is closest (AD hierarchy) to the affected
object (user or computer) will take precedence. In other words, if a there
is a conflicting setting between a Domain GPO and an OU GPO the OU setting
will "win". BUT notice that I have not considered environments where you use
Enforce/Block Inheritance/Group Filtering, just the default scenario...

Regards,
/Jimmy
--
Jimmy Andersson, Q Advice AB
Microsoft MVP - Directory Services
---------- www.qadvice.com ----------


"Cary Shultz [A.D. MVP]" <cwshultz@mvps.org> wrote in message
news:uC9RPqwXFHA.616@TK2MSFTNGP12.phx.gbl...
> Another very good basic question! Actually, these types of questions are
> very helpful for a lot of people learning!
>
> If you are using the Active Directory Users and Computers MMC and you
> right click on an OU and select Properties and then click on the Policy
> tab you will see the four GPOs. First, the one on the bottom is
> processes. Then, the one directly above that is processed. Then, the one
> above that and finally the one listed at the top is processed. So, it
> starts at the bottom and finishes at the top!
>
> Should there be something common in multiple GPOs then the last one
> processed wins! So, if there was something common with the GPO listed at
> the bottom and the GPO listed at the top the setting from the GPO listed
> at the top would win ( as it is processed last ).
>
> --
> Cary W. Shultz
> Roanoke, VA 24012
> Microsoft Active Directory MVP
>
> http://www.activedirectory-win2000.com
> http://www.grouppolicy-win2000.com
>
>
>
> "Ricardo" <Ricardo@discussions.microsoft.com> wrote in message
> news:35928B5A-ED1F-48D9-A7D1-194F56DB2ED2@microsoft.com...
>> In a OU a have 4 GPOs linked.
>> Which one will be applyed first ? The one in the top or the last one ?
>
>
 
G

Guest

Guest
Archived from groups: microsoft.public.win2000.active_directory (More info?)

Oh... I should have read the other post (GPO Flow) since this is already
answered.... :|

Regards,
/Jimmy
--
Jimmy Andersson, Q Advice AB
Microsoft MVP - Directory Services
---------- www.qadvice.com ----------


"Jimmy Andersson [MVP]" <jimmy_NO_SPAM_@mvps.org> wrote in message
news:u7de8w4XFHA.2540@tk2msftngp13.phx.gbl...
> And to add some more info on GPOs :)
> The processing order of GPOs are:
>
> 1. Local
> 2. Site
> 3. Domain
> 4. OU
>
> This means that the setting that is closest (AD hierarchy) to the affected
> object (user or computer) will take precedence. In other words, if a there
> is a conflicting setting between a Domain GPO and an OU GPO the OU setting
> will "win". BUT notice that I have not considered environments where you
> use Enforce/Block Inheritance/Group Filtering, just the default
> scenario...
>
> Regards,
> /Jimmy
> --
> Jimmy Andersson, Q Advice AB
> Microsoft MVP - Directory Services
> ---------- www.qadvice.com ----------
>
>
> "Cary Shultz [A.D. MVP]" <cwshultz@mvps.org> wrote in message
> news:uC9RPqwXFHA.616@TK2MSFTNGP12.phx.gbl...
>> Another very good basic question! Actually, these types of questions are
>> very helpful for a lot of people learning!
>>
>> If you are using the Active Directory Users and Computers MMC and you
>> right click on an OU and select Properties and then click on the Policy
>> tab you will see the four GPOs. First, the one on the bottom is
>> processes. Then, the one directly above that is processed. Then, the
>> one above that and finally the one listed at the top is processed. So,
>> it starts at the bottom and finishes at the top!
>>
>> Should there be something common in multiple GPOs then the last one
>> processed wins! So, if there was something common with the GPO listed at
>> the bottom and the GPO listed at the top the setting from the GPO listed
>> at the top would win ( as it is processed last ).
>>
>> --
>> Cary W. Shultz
>> Roanoke, VA 24012
>> Microsoft Active Directory MVP
>>
>> http://www.activedirectory-win2000.com
>> http://www.grouppolicy-win2000.com
>>
>>
>>
>> "Ricardo" <Ricardo@discussions.microsoft.com> wrote in message
>> news:35928B5A-ED1F-48D9-A7D1-194F56DB2ED2@microsoft.com...
>>> In a OU a have 4 GPOs linked.
>>> Which one will be applyed first ? The one in the top or the last one ?
>>
>>
>
>
 
G

Guest

Guest
Archived from groups: microsoft.public.win2000.active_directory (More info?)

Jimmy,

Better to have two answers than none!

--
Cary W. Shultz
Roanoke, VA 24012
Microsoft Active Directory MVP

http://www.activedirectory-win2000.com
http://www.grouppolicy-win2000.com



"Jimmy Andersson [MVP]" <jimmy_NO_SPAM_@mvps.org> wrote in message
news:u00ga04XFHA.228@TK2MSFTNGP12.phx.gbl...
> Oh... I should have read the other post (GPO Flow) since this is already
> answered.... :|
>
> Regards,
> /Jimmy
> --
> Jimmy Andersson, Q Advice AB
> Microsoft MVP - Directory Services
> ---------- www.qadvice.com ----------
>
>
> "Jimmy Andersson [MVP]" <jimmy_NO_SPAM_@mvps.org> wrote in message
> news:u7de8w4XFHA.2540@tk2msftngp13.phx.gbl...
>> And to add some more info on GPOs :)
>> The processing order of GPOs are:
>>
>> 1. Local
>> 2. Site
>> 3. Domain
>> 4. OU
>>
>> This means that the setting that is closest (AD hierarchy) to the
>> affected object (user or computer) will take precedence. In other words,
>> if a there is a conflicting setting between a Domain GPO and an OU GPO
>> the OU setting will "win". BUT notice that I have not considered
>> environments where you use Enforce/Block Inheritance/Group Filtering,
>> just the default scenario...
>>
>> Regards,
>> /Jimmy
>> --
>> Jimmy Andersson, Q Advice AB
>> Microsoft MVP - Directory Services
>> ---------- www.qadvice.com ----------
>>
>>
>> "Cary Shultz [A.D. MVP]" <cwshultz@mvps.org> wrote in message
>> news:uC9RPqwXFHA.616@TK2MSFTNGP12.phx.gbl...
>>> Another very good basic question! Actually, these types of questions
>>> are very helpful for a lot of people learning!
>>>
>>> If you are using the Active Directory Users and Computers MMC and you
>>> right click on an OU and select Properties and then click on the Policy
>>> tab you will see the four GPOs. First, the one on the bottom is
>>> processes. Then, the one directly above that is processed. Then, the
>>> one above that and finally the one listed at the top is processed. So,
>>> it starts at the bottom and finishes at the top!
>>>
>>> Should there be something common in multiple GPOs then the last one
>>> processed wins! So, if there was something common with the GPO listed
>>> at the bottom and the GPO listed at the top the setting from the GPO
>>> listed at the top would win ( as it is processed last ).
>>>
>>> --
>>> Cary W. Shultz
>>> Roanoke, VA 24012
>>> Microsoft Active Directory MVP
>>>
>>> http://www.activedirectory-win2000.com
>>> http://www.grouppolicy-win2000.com
>>>
>>>
>>>
>>> "Ricardo" <Ricardo@discussions.microsoft.com> wrote in message
>>> news:35928B5A-ED1F-48D9-A7D1-194F56DB2ED2@microsoft.com...
>>>> In a OU a have 4 GPOs linked.
>>>> Which one will be applyed first ? The one in the top or the last one ?
>>>
>>>
>>
>>
>
>
 
You must log in or register to reply here.

TRENDING THREADS

Latest posts

Moderators online

Share this page

COMPANY
RESOURCES
FOLLOW
Top Bottom