11

If two or more GPOs are applied to the same OU (and they have contradictory policies), which would be applied?

For example, if there is a GPO with the computer policy "Enable autoplay on all drives" set to "enabled" in one GPO, and "disabled" in another GPO, and they are both applied to the same computer OU... which would take precedence?

Improve this question

1 Answer 1

Reset to default
16

GPOs have a link order for just this sort of thing.

"Links to a specific site, domain, or organizational unit are applied in reverse sequence based on link order. For example, a GPO with Link Order 1 has highest precedence over other GPOs linked to that container."

http://technet.microsoft.com/en-us/library/cc757050(v=WS.10).aspx

Improve this answer
4
  • So, to clarify, whichever one is applied last in the link order except for when a policy that has the "No Override" option set.
    – Rex
    Jul 5, 2013 at 22:06
  • 6
    It's known as "Enforced" these days. Setting a GPO to enforced effectively moves it to the end of the processing order, meaning it always wins. If you have multiple conflicting Enforced GPOs they go in reverse order. (The 'higher' one in the OU structure wins,) But if it ever got that complex, you would need to rethink your overall GPO strategy in my opinion.
    – Ryan Ries
    Jul 5, 2013 at 22:17
  • Call me old school. :) I know it's called enforced now but I was quoting from the technet link you posted. Didn't want to confuse the poor soul with enforced vs no override
    – Rex
    Jul 5, 2013 at 22:20
  • I already know "enforced" is the new "no override". We have an SBS 2003 server and even that has "enforced", so it must have been this way for at least a decade.
    – Austin ''Danger'' Powers
    Jul 5, 2013 at 22:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.