IT Guys: Q&A Pt. 2

[zachary]

Okay IT guys, here is one that should be simple enough.

I have two GPO's on my domain.

My top level "default" GPO that is applied to all users. It handles drive mappings and default home page, etc. Basics.

I also have a GPO for a select few users that blocks their ability to get to the web.

I have this "no internet" gpo set to Enforce, but not my top level GPO.

Should they both be set to Enforce? Or would that cause the top level to override the bottom one?

[tc95]

I stole this from here....better explianation then I would have done...... GPO - Wikipedia

Processing order for policy settings Group policies are processed in the following order:

• 1.Local Group Policy objects - This applies to any settings in the computer's local policy (accessed by running gpedit.msc). Previous to Windows Vista, there was only one local group policy stored per computer. There are now individual group policies settable per account of a Windows Vista and 7 machine.

• 2.Site - Next the computer processes any group policies that are applied to the site the computer is currently in. If multiple policies are linked to a site these are processed in the order set by the administrator using the Linked Group Policy Objects ta
  b, policies with the lowest link order are processed last and have the highest precedence.

• 3.Domain - Any policies applied at the domain level (default domain policy) are processed next. If multiple policies are linked to a domain these are processed in the order set by the administrator using the Linked Group Policy Objects tab, policies with the lowest link order are processed last and have the highest precedence.

• 4.Organizational Unit - Last group policies assigned to the organizational unit that contains the computer or user are processed. If multiple policies are linked to an organizational unit these are processed in the order set by the administrator using the Linked Group Policy Objects tab, policies with the lowest link order are processed last and have the highest precedence.

Inheritance - Inheritance can be blocked or enforced to control what policies are applied at each level. If a higher level administrator (enterprise administrator) creates a policy that has inheritance blocked by a lower level administrator (domain administrator) this policy will still be processed.
Where a Group Policy Preference Settings is configured and there is also an equivelant Group Policy Setting configured then the value of the Group Policy Setting will take precedence.


I think this answers it all...Hope it helps..