GPO link order

[Ausy]

When you have multiple gpos assigned to an OU, what order are they actually applied. 3 first or 1 first?

 

Example

Link Order

1

2

3

[Chuckster]

Link order would be

 

1

2

3

4

5 etc

 

5 is the highest and takes precedence first, followed by 4, 3, 2, and 1. In other words, 5 is applied first and 1 will be the last GPO to be applied.

 

Hope that makes sense.

[Ausy]

Excellent, thanks

[sonofsanta]

Pro tip: in your Group Policy Management Console, click on an OU, click on the Group Policy Inheritance tab, and it shows you all the GPOs that will be applied in order, bottom up. You can remember that it's bottom up because Default Domain Policy (the weakest GPO) is always at the bottom.

 

Enforced GPOs will catch you out: normal policies apply from the broadest scope first, then get more and more specific (and stronger) as you get to the actual OU. Enforced policies then go back down the chain - so an enforced policy on the OU is applied before an enforced policy on the domain, and thus the enforced domain policy is the strongest GPO you can get.

 

It helps if you realise that all group policies do are make registry changes, and thus any policy that runs later simply overwrites the registry entry from an earlier policy, and thus wins out.