I have a domain with 4 OUs in it. The domain level Policy sets security policy for the whole domain. In 2 of the lower OUs I want to overwrite some of the security settings with different settings while keeping the rest of the domain security settings. The domain level policy is not Enforced but it is linked. The OU Policy in the lower OUs is enforced but it is not over-writing the linked domain policy.

How do I make the lower OUs take precedence over the domain level policy for these 2 OUs?

EDIT** I have found the OU policy is applying but the winning GPO is the domain level GPO. Some policies are showing up in Computer configuration but not in User configuration.

  • Which settings specifically? – joeqwerty Aug 5 '16 at 13:27
  • @joeqwerty One setting would be to disable the enforced screensaver. Also power settings changes. – JukEboX Aug 5 '16 at 13:29
  • The OU policy is Enforced but not taking precedence over the domain policy. Actually lower level policies do take precedence over higher-level policies, unless the higher level policies are enforced. You may want to re-phrase that to say it is not working. – Greg Askew Aug 5 '16 at 13:32
  • @joeqwerty Thanks. Reworked the question. Is that a little better? – JukEboX Aug 5 '16 at 13:36
  • Some security settings are domain wide and can't be defined at an OU level (such as the domain Password Policy). If you're trying to configure any of these settings at an OU level then it can't be done. If you're trying to set a different Password Policy you'll need to look into FGPP (Fine-grained password policies). Have a read here for which settings have domain-wide scope - technet.microsoft.com/en-us/library/cc960657.aspx. If you're interested in configuring FGPP then have a read here - technet.microsoft.com/en-us/library/cc770842(v=ws.10).aspx – joeqwerty Aug 5 '16 at 13:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.