In this video from ITFreeTraining I will look at the order used when more than one Group
Policy is applied. It is important for the administrator to understand this so they can
be assured that the settings they intended to be applied to the user or computer are
applied.
When multiple Group Policies are applied, Group Policies applied at different parts
of the domain and locally will have different precedence than other Group Policies. Precedence
essentially means they will overwrite previous settings when there is a conflict.
At the top, you have OUs’. A Group Policy applied to an OU will override all other Group
Policies that have been applied before it. Child OU’s have the most preference and
will override the settings configured from the parent when there is a conflict.
Next you have Group Policy applied at the Domain level. Group Policies applied at the
OU level will override Domain settings; however, settings applied at the Domain level will
override any other settings.
The next level is Site. Settings applied at the OU and Domain level will override settings
applied at the site level.
Lastly you have local Group Policy. This is the weakest Group Policy as settings applied
anywhere else will override the settings applied at local Group Policy. So how is this achieved?
To achieve this, Group Policy is simply applied in the reverse order. Local Group Policy is
applied first. Any settings that are applied in Local Group Policy can be over written
by any other Group Policy. You can also see that since OU’s are applied last, any setting
applied at the OU level can override any other settings applied at the local, site or Domain
level. Let’s look at an example which will make this a bit easier to understand.
In this example, the user has configured the local Group Policy to change the desktop wallpaper
on the computer to a picture of a cat. When Group Policy is applied, the result will be
the wallpaper on the computer will be changed to a picture of a cat.
Although the desktop wallpaper image of the cat is quite cute, management has decided
that they do not want this and would like to go for something more corporate. So at
the Domain level a boring corporate wall paper is applied. This will override the local setting.
In some cases the administrator may want to further override the setting applied at the
domain. In this case a desktop wallpaper is applied at the New York OU for all New York
users. This will override the previous setting.
In some cases you may want to override settings from a child OU. In this case, the Sales OU
will apply a different wallpaper setting. This will override all other settings. You
can see how Group Policy preference works where low preference Group Policy will be
overwritten by higher preference Group Policy. But what happens when you have two or more
Group Policies applied at the same level?
When multiple group policies exist at the same level, the precedence is determined by
the link order. This can be configured in “Group Policy Management”. If I have a
look at an example, you can see that 3 different Group Policies have been applied to the New
York OU. To the left of the Group Policies is the link order. Like before, in order to
ensure the Group Policy with the highest link order has the lowest precedence, the order
the group policy is applied is reversed.
To understand this better, consider the link order for the 3 group policies. So what would
the processing order be for these Group Policies? It would be the reverse. Since the 3rd Group
Policy is applied first, this means that any setting in the second and first Group Policy
can override the settings applied in that group policy.
The last point to consider is how the different parts of group policy work. Group Policy is
divided into computer configuration and user configuration. The computer side of Group
Policy is applied during start up. Until this Group Policy is applied the user will not
be able to login.
User settings are applied when the user logs in. The user will not be given control of
the desktop until the Group Policy settings have been applied.
This covers how Group Policy settings are applied when multiple Group Policies are present.
This is just one of the videos in our Group Policy course. I hope to see you in the others,
until then, thanks for watching.