Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an OU for Servers, and a sub-OU for TerminalServers. In the Servers OU, I have a GPO that is link-enabled and enforced called ServerFirewallPolicy. In the TerminalServers OU, I have a GPO that is link-enabled and enforced called TSFirewallPolicy.

In ServerFirewallPolicy, there is a setting for allowing RDP-in but only within a custom scope of defined subnets. In TSFirewallPolicy, there is the same setting allowing RDP-in but for any host (ie public RDP server).

My understanding of GPO inheritance and order of application is that the outermost OU is processed last, so in this case, the ServerFirewallPolicy would take precedence, and that is exactly what is happening - my servers under TerminalServers are being restricted to the custom scope defined in ServerFirewallPolicy.

How can I change the order of application so that ServerFirewallPolicy is still evaluated (as it has many common and useful rules for all servers) but TSFirewallPolicy takes precedence?

share|improve this question
up vote 1 down vote accepted

You cannot change the GPO application order, and your understanding of the order of application ("outermost OU is processed last") is not accurate. (Edit: my apologies - I mean my understanding of your understanding of GPO application order. It is possible that I misunderstood you, but it was worded in a way that made me think you had it wrong.)

Local policies get applied first. Then policies linked at the Site level. Then policies linked at the Domain level. Then policies linked to OUs. Policies linked to higher OUs are processed first, such that GPOs that are linked to the OU "closest" to the target are applied last, overwriting conflicting settings that may have come before. Lastly, if multiple GPOs are linked to a single OU they are processed from the bottom up. (I believe that to be obsolete - it should be in terms of link order now.)

Last writer wins.

You may exploit the "Enforce" and "Block Inheritance" behaviors at the various levels, and you can also use Loopback Processing, but you can't change that fundamental order.

Servers (ServerFirewallPolicy[ENFORCED])
    +---TerminalServers (TSFirewallPolicy[ENFORCED])

From Technet:

Enforcing a GPO link

You can specify that the settings in a GPO link should take precedence over the settings of any child object by setting that link to Enforced. GPO-links that are enforced cannot be blocked from the parent container. Without enforcement from above, the settings of the GPO links at the higher level (parent) are overwritten by settings in GPOs linked to child organizational units, if the GPOs contain conflicting settings. With enforcement, the parent GPO link always has precedence. By default, GPO links are not enforced. In tools prior to GPMC, "enforced" was known as "No override."

share|improve this answer
So my understanding was wrong, but why is the GPO for the higher-level OU taking precedence?? – tacos_tacos_tacos Aug 13 '12 at 19:39
Because you chose the "Enforce" option on the ServerFirewallPolicy GPO, which is linked to a higher-level OU, but the Enforce option does just that - it makes it override GPOs below it that would have taken precedence had you not chosen the Enforce option. – Ryan Ries Aug 13 '12 at 19:43
I see... so my understanding of "Enforce" must have been wrong. "Enforce" has to do with order-of-application, not enabling/disabling – tacos_tacos_tacos Aug 13 '12 at 19:48
I just edited my initial answer. Notice the last paragraph that describes GPO Enforcement. Using Enforce on a parent GPO does make it act a little funny in that Enforced GPOs do take precedence as the parent, whereas normally they do not! :) – Ryan Ries Aug 13 '12 at 19:50

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.