0

If we have this Group Policy Management configuration (Windows Server 2008):

domain.local
    OU1
        PC1
        USR1
        GPO1 (Linked)
    OU2
        PC2
        USR2
        GPO2 (Linked)

And USR2 tries to login to PC1, in which order will the GPOs be applied?

  1. GPO1 Computer Configuration > GPO1 User Configuration > GPO2 Computer Configuration > GPO2 User Configuration

OR

  1. GPO2 Computer Configuration > GPO2 User Configuration > GPO1 Computer Configuration > GPO1 User Configuration

OR

  1. GPO1 Computer Configuration > GPO2 Computer Configuration > GPO1 User Configuration > GPO2 User Configuration

OR

  1. GPO2 Computer Configuration > GPO1 Computer Configuration > GPO2 User Configuration > GPO1 User Configuration
0

Separating the computer and user configuration from each GPO doesn't really make much sense. Each GPO is applied in a processing order, and whether each of them contains user, computer or both kinds of settings doesn't affect that. Though in general, it's fair to say that computer configuration is applied first, since it's processed at computer startup instead of at user logon.

As to the order in your example, computer configuration from GPO1 will be applied to PC1 when it starts. Then user settings from GPO2 will be applied to USR2 when he logs on. Any other settings won't be applied.
The only caveat I can think of here, is if you've got loopback processing enabled in GPO1. In that case, user settings from GPO1 will be applied as well, and take precedence over user settings in GPO2. (Or completely replace them if you enabled loopback processing in "Replace" instead of "Merge" mode.)

As a slight note on the side, keep in mind that you kan change the link order of GPOs in an OU manually, if you ever need more fine grained control over what GPO has preference.

0

Check this blog. Might help you to get an idea.

  • That doesn't help, thank you anyway. – Jalil Jan 27 '15 at 8:17
0

It always run the same way the order is in a cmd command:

GPRESULT /R

this will be the output: Microsoft Windows [Version 6.3.9600] (c) 2013 Microsoft Corporation. All rights reserved.

 C:\Users\j0rt3g4>gpresult /r

 Microsoft (R) Windows (R) Operating System Group Policy Result tool v2.0
 © 2013 Microsoft Corporation. All rights reserved.

 Created on 06-02-2015 at 12:27:15 a.m.


 RSOP data for LAP\j0rt3g4 on LAP : Logging Mode
 ------------------------------------------------

 OS Configuration:            Standalone Workstation
 OS Version:                  6.3.9600
 Site Name:                   N/A
 Roaming Profile:             N/A
 Local Profile:               C:\Users\j0rt3g4
 Connected over a slow link?: No


 USER SETTINGS
 --------------

     Last time Group Policy was applied: 02-02-2015 at 03:21:00 a.m.
     Group Policy was applied from:      N/A
     Group Policy slow link threshold:   500 kbps
     Domain Name:                        LAP
     Domain Type:                        <Local Computer>

     Applied Group Policy Objects
     -----------------------------
         N/A

     The following GPOs were not applied because they were filtered out
     -------------------------------------------------------------------
         Local Group Policy
             Filtering:  Not Applied (Empty)

     The user is a part of the following security groups
     ---------------------------------------------------
         High Mandatory Level
         Everyone
         Local account and member of Administrators group
         HomeUsers
         BUILTIN\Administrators
         Hyper-V Administrators
         Performance Log Users
         BUILTIN\Users
         NT AUTHORITY\INTERACTIVE
         CONSOLE LOGON
         NT AUTHORITY\Authenticated Users
         This Organization
         jortega928@yahoo.com
         Local account
         LOCAL
         Microsoft Account Authentication

 C:\Users\j0rt3g4>

and this way you can see the all the GPO objects from a user and from a computer. The order is inverse meaning always will run at the end the default domain policy and default domain controller policy.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.