Set GPO to override default domain policy?

[maxrebo]

I Would like to set the pupils GPO to a different Internet Homepage than everyone else. Currently the homepage for everyone is configured in the Default domain policy. How do i get this GPO to override the DDP but just for the pupils?

 

cheers

[Oaktech]

You don't...

 

You unset the policy in DDP. You create a gpo with the student homepage in it and apply it to the student OU, you create a policy with everyone elses homepage in it, you apply it to everyone elses OU or multiple OUs.

 

If your users are all mashed in together (they really shouldn't be) you will still need to create 2 GPOs but in the scope section you will need to set which security groups they apply to to differentiate between students and everyone else.

[sonofsanta]

You can enforce a policy with a right click, so that it takes precedence, but as @Oaktech says you shouldn't, because if you're setting and then overriding and then overriding and then... you're only slowing logins down unnecessarily and making it complicated & confusing for you to administer. Organise with OUs and apply GPOs at the the correct level.

[JoHimself]

How much stuff do you have in the DDP? You should seriously consider moving everything out of there.

 

As others have said you shouldn't really enable/disable/enable using policies as it slows everything down. I have in the past had separate OUs for staff and students and then applied "All Users" policies to the root then separate "Staff" and "Student" policies applied directly to the staff and student OUs.

 

If you need to override (and as I said you shouldn't), then Local policy is applied first followed by Domain policy. This means local policies will be overridden by domain ones. Domain policies flow down the OU structure so if there is DOMAIN ROOT > Users > Staff with a GPO applied at each OU you will have DDP applied followed by Users and finally Staff. For more info see https://technet.microsoft.com/en-gb/library/cc785665

 

As for enforcing policies, I am a firm believer that (in most cases) if you have to enforce or block inheritance then you have a flaw in the OU/GPO design.

Edited November 16, 2015 by JoHimself

[maxrebo]

How much stuff do you have in the DDP? You should seriously consider moving everything out of there.

 

As others have said you shouldn't really enable/disable/enable using policies as it slows everything down. I have in the past had separate OUs for staff and students and then applied "All Users" policies to the root then separate "Staff" and "Student" policies applied directly to the staff and student OUs.

 

If you need to override (and as I said you shouldn't), then Local policy is applied first followed by Domain policy. This means local policies will be overridden by domain ones. Domain policies flow down the OU structure so if there is DOMAIN ROOT > Users > Staff with a GPO applied at each OU you will have DDP applied followed by Users and finally Staff. For more info see https://technet.microsoft.com/en-gb/library/cc785665

 

As for enforcing policies, I am a firm believer that (in most cases) if you have to enforce or block inheritance then you have a flaw in the OU/GPO design.

 

Hi thanks for your advice, dont have much in the DDP, I will make that change and put the internet settings in each policy.

[Oaktech]

I was speaking to an MS MVP a few months ago and he was of the impression that the only things that should legitimately be in the DDP are password requirements, default logon domain and logon requirements (require ctrl alt del etc) and bit locker requirements, that should be about it.

[JoHimself]

I've certainly never put anything in the DDP. I've seen all kinds of horrorshows of those who have though.

 

Probably best left alone.