I have an OU for
Servers, and a sub-OU for
TerminalServers. In the
Servers OU, I have a GPO that is link-enabled and enforced called
ServerFirewallPolicy. In the
TerminalServers OU, I have a GPO that is link-enabled and enforced called
ServerFirewallPolicy, there is a setting for allowing
RDP-in but only within a custom scope of defined subnets. In
TSFirewallPolicy, there is the same setting allowing
RDP-in but for any host (ie public RDP server).
My understanding of GPO inheritance and order of application is that the outermost OU is processed last, so in this case, the
ServerFirewallPolicy would take precedence, and that is exactly what is happening - my servers under
TerminalServers are being restricted to the custom scope defined in
How can I change the order of application so that
ServerFirewallPolicy is still evaluated (as it has many common and useful rules for all servers) but
TSFirewallPolicy takes precedence?