Information Technology Reference
In-Depth Information
This objective covers how to:
■
Configure processing order and precedence
■
Configure blocking of inheritance
■
Configure enforced policies
■
Configure security filtering and Windows Management Instrumentation (WMI)
filtering
■
Configure loopback processing
■
Configure and manage slow-link processing and Group Policy caching
■
Configure client-side extension (CSE) behavior
■
Force Group Policy updates
Multiple Group Policy Objects (GPOs) can be linked to the same site, domain, or organizational
unit (OU), and OUs inherit GPOs from higher-level containers. GPOs are processed serially, with
local computer Group Policy processed first. Inherited GPOs are then processed, unless they
are blocked or enforced (see the sections entitled “Configuring blocking of inheritance” and
“Configuring enforcement of inheritance” later in this chapter). The GPOs linked directly to the
domain or OU are processed in the order they are linked; then enforced GPOs are processed.
Where multiple GPOs are configuring the same Group Policy setting, the last one processed
controls the setting. You can control the order of linking for an OU or domain, as well as con-
trolling inheritance to some extent. You can block inheritance at the domain or OU level, but
where the higher-level link to the GPO is set to Enforced, the inheritance can't be blocked and
enforced links are the last processed—again, in the reverse link order.
To see the order of linked GPOs, use the Group Policy Management Console (GPMC).
Select the domain or OU for which you want to see the link order in the console tree, and
then select the Linked Group Policy Objects tab in the details pane, as shown in Figure 6-1.
To change the link order, select a link in the Linked Group Policy Objects pane and then
use the arrow buttons on the left to move the order up or down, as desired. Move a linked
GPO to a lower Link Order number to have it processed later. Thus a GPO with a Link Order
of 1 will be processed after a GPO with a Link Order of 2; and if both GPOs have a policy con-
figuration for the same setting, the GPO with a Link Order of 1 will be the controlling GPO.
Remember that policy settings can also be inherited. To see all the GPOs that affect a
given OU or domain, use the GPMC and follow these steps:
1.
Expand the console tree of the GPMC and select the OU or domain for which you want
to see the GPOs.
2.
In the details pane, select the Group Policy Inheritance tab, as shown in Figure 6-2.
