If two different GPO have few common settings then which one will apply

Daisy Zhou 18,721 Reputation points Microsoft Vendor
2020-08-07T07:48:14.09+00:00

My OU structure is like FACILITIES--->India-->Mumbai, Pune. FACILITIES is root OU then India will be sub OU and then Mumbai, Pune will be under India OU. I have applied a GPO under FACILITIES to add 3 groups A, B , C in local computer as administrator. Now I have to apply one GPO under Mumbai which will have setting to Add only group A as local Admin and remove B, C from local Administrator.
My question is which GPO will win between FACULTIES or Mumbai?

Source: https://social.technet.microsoft.com/Forums/windowsserver/en-US/086c757b-554f-4bba-a503-5e47b8352ea1/if-two-different-gpo-have-few-common-settings-then-which-one-will-apply?forum=winserverGP

Windows
Windows
A family of Microsoft operating systems that run across personal computers, tablets, laptops, phones, internet of things devices, self-contained mixed reality headsets, large collaboration screens, and other devices.
4,802 questions
0 comments
Accepted answer
  1. Hannah Xiong 6,231 Reputation points
    2020-08-07T07:54:34.613+00:00

    Hello,

    Thank you for posting in our TechNet forum.

    By default, Group Policy is inherited and cumulative, and it affects all computers and users in an Active Directory container.

    When we link a GPO to an OU, the GPO applies to the computers and users in every child OU. This concept is called inheritance.

    If you apply a GPO to a branch, any limb of that branch receives he same GPO unless explicitly blocked. Similarly, if you apply a GPO at the root, all branches receive the GPO, too. So unless you expressly prohibit inheritance, anything applied at the top, is applied underneath it.

    In general, the order in which Group Policy applies GPOs determines precedence. The order is site, domain, OU, and child OUs. As a result, GPOs in child OUs have a higher precedence than GPOs linked to parent OUs, which have a higher precedence than GPOs linked to the domain, which have a higher precedence than GPOs linked to the site.

    So if a policy in the lower-level child OU is set, this setting value will override the setting value inherited by its higher-level parent OU. In general, the setting in the lower-level OU will not affect the setting in higher-level OU. So the GPO under Mumbai will win.

    Overriding and Blocking Group Policy
    https://learn.microsoft.com/en-us/previous-versions/windows/desktop/policy/overriding-and-blocking-group-policy

    For any question, please feel free to contact us.

    Best regards,
    Hannah Xiong

    0 comments

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest