The order of processing for GPOs
As we learned in the previous section, GPOs can be linked to an AD site, domain, or OU and will be applied to any user or computer object in that container.
Each GPO will be processed in the following order of inheritance:
- Local policy
- Site-level linked GPO
- Domain-level linked GPO
- OU-level linked GPO
The following illustration aims to outline the order of linked GPO processing:
Figure 3.7 – Domain GPO processing order
The settings applied to the user and computer objects will be the combined effect of policies linked at each level, creating a Resultant Set of Policies (RSoP). There can be multiple GPOs linked at each container level.
When one GPO has the same policy setting as a different value to another linked GPO, there will be a conflict; for example, prevent shutdown may be enabled in a site GPO, but the same setting might have a value of disabled in a GPO linked to a lower container...
