Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Our environment consists of a 2003 Active Directory with about 50% split regarding XP and Windows 7 clients. Our security policy states that by default everyone's desktop should lock at 2 hours for the screensaver. For select users, the policy states their Desktops should lock at 15minutes after inactivity.

We have applied the 2 hour policy by creating a GPO and linking it to the Organization OU. This works fine for all clients. Security Filtering has the GPO applying to all Authenticated users.

For the 15min screensaver lock, we have the same GPO and linked it to the domain but this time by Security Filtering we only apply it to a particular security group. This GPO is not working correctly.

We are currently drawing a blank on how to either implement or fix the 15minute GPO for screensaver lock.

share|improve this question
If you look at the GP results, does the group policy apply to the user, does it get denied, or does it not show up at all? – Zoredache May 1 '12 at 21:21
up vote 3 down vote accepted

Group Policy processing order is as such:

LSDOU = Local, Site, Domain, Organizational Unit

Even with the Security Filtering, the GPO setting in the domain linked GPO is being over-ridden by the GPO linked at the OU. To get around that you could link the 15 minute GPO to the OU with a lower link order or you could set the GPO at the domain level as Enforced.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.