What are group policies?
Group policies specify how programs, network resources, and the
operating system work for users and computers in an organization. They
are collections of user and computer configuration settings that are
applied on the users and computers (not on groups). For better
administration of group policies in the Windows environment, the group
policy objects (GPOs) are used.
What is GPO?
Group policy object (GPO) is a collection of group policy settings.
It can be created using a Windows utility known as the Group Policy
snap-in. GPO affects the user and computer accounts located in sites,
domains, and organizational units (OUs). The Windows 2000/2003 operating
systems support two types of GPOs, local and non-local (Active
Directory-based) GPOs.
What is Local GPOs/policy?
Local GPOs are used to control policies on a local server running
Windows 2000/2003 Server. On each Windows server, a local GPO
is stored. The local GPO affects only the computer on which it is
stored. By default, only Security Settings nodes are configured. The
rest of the settings are either disabled or not enabled. The local GPO
is stored in the %systemroot%SYSTEM32GROUPPOLICY folder.
What is Non-local Policy?
Non-local GPOs are used to control policies on an Active
Directory-based network. A Windows server needs to be
configured as a domain controller on the network to use a non-local GPO.
The non-local GPOs must be linked to a site, domain, or organizational
unit (OU) to apply group policies to the user or computer objects. The
non-local GPOs are stored in %systemroot%SYSVOLPOLICIESADM, where is the
GPO’s globally unique identifier. Two non-local GPOs are created by
default when the Active Directory is installed:
1. Default Domain Policy: This GPO is linked to the domain and it affects all users and computers in the domain.
2. Default Domain Controllers Policy: This GPO is linked to the Domain
Controllers OU and it affects all domain controllers placed in this OU.
Multiple GPOs
GPO Apply order
When multiple group policy objects are assigned, the group policies are applied in the following order:
• The local group policy object is applied first
• Then, the group policy objects linked to sites are applied
If multiple GPOs exist for a site, they are applied in the order specified by an administrator
• GPOs linked to the domains are applied in the specified order
• Finally, GPOs linked to OUs are applied
The OU group policy objects are set from the largest to the smallest
organizational unit, i.e., first the parent OU and then the child OU.
By default, a policy applied later overwrites a policy that was applied
earlier. Hence, the settings in a child OU can override the settings in
the parent OU
Group policy settings are cumulative if they are compatible with each
other. In case they conflict with each other, the GPO processed later
takes precedence.
What is No Override? Block Policy Inheritance?
The following are the exceptions with regard to the above-mentioned settings:
No Override:
Any GPO can be set to No Override. If the No Override configuration
is set to a GPO, no policy configured in the GPO can be overridden. If
more than one GPO has been set to No Override, then the one that is the
highest in the Active Directory hierarchy takes precedence
Block Policy Inheritance:
The Block Policy Inheritance option can be applied to the site,
domain, or OU. It deflects all group policy settings that reach the
site, domain, or OU from the object higher in the hierarchy. However,
the GPOs configured with the No Override option are always applied
What is Loopback policy?
Is group policy from Parent Domain cab be inherited to child Domain?
Group Policy Inheritance
The group policies are inherited from parent to child within a domain. They are not inherited from parent domain to child domain
Following are the rules regarding group policy inheritance:
A policy setting is configured (Enabled or Disabled) for a parent OU,
and the same policy setting is not configured for its child OUs. The
child OUs inherit the parent’s policy
A policy setting is configured (Enabled or Disabled) for a parent OU,
and the same policy setting is configured for its child OUs. The child
OUs settings override the settings inherited from the parent’s OU
If any policy is not configured, no inheritance takes place
Compatible policy settings configured at the parent and child OUs are accumulated
Incompatible policy settings from the parent OU are not inherited