2

As per gpresult /r, there is an existing DC applied GPO for trusted sites.

GPO Name: GPO-NAM-IE-TRUSTEDSITES

I added a site in Internet Explorer Security sites zone under via local group policy editor(gpedit.msc). Ran gpupdate /force and reboot the box. Site was added in IE trusted sites zone list.

Does this mean that local GPO always take precedence over DC applied GPO or in case configuration is done on same object? What is rule of thumb? OR

Could it possible that DC applied GPO is misconfigured? OR

Could it be something to do with my domain user id is member of Administrators group on my Win7 box?

Please explain..

  • Please consider marking one of the answers you received as an accepted answer. – Twisty Impersonator Jan 7 '17 at 17:14
2

This is the expected behavior. The Internet Explorer Site To Zone Assignment List settings are merged when there are settings from multiple policies. You may use gpresult /h to display the resultant set of policy and winning policies.

enter image description here

If all of the site to zone assignments were in a single registry value, the domain policy would override the local policy. If the same site were specified in both domain and local group policy, the domain policy would override the local policy. For example, if microsoft.com were defined in the Internet Zone in domain policy, and Trusted Sites Zone in local policy, the domain policy setting would override and microsoft.com would be in the Internet Zone. But each site is a separate registry value, and the settings for the individual sites are merged.

The only way to prevent the local policy settings would be to enable the group policy setting:

Computer > Policies > Administrative Templates > System > Group Policy: Turn off Local Group Policy Objects processing.

1

As Greg stated in his answer, Internet Explorer Site To Zone Assignment List settings are merged when there are settings from multiple policies.

But to answer your general question: Does this mean that local GPO always take precedence over DC applied GPO or in case configuration is done on same object? What is rule of thumb?

If we ignore policy enforcement and inheritance blocking for a minute, group policies are applied in the following order of precedence:

LSDOU:

Local

Site

Domain

Organizational Unit

Which means that local Group Policy is applied first and has the lowest precedence, which means that when there is a policy setting conflict (a policy setting configured in more than one policy), local Group Policy will be over-ridden by Site linked policies, Domain linked policies and Organizational Unit linked policies.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.