Upgrading on a granular level GPO WUFB

[Warwick_Tech]

Hi All,

 

Hopefully an easy one - We use WUFB to manage our updates and currently the policy is defined between 'staff' and 'student' machines so we can control the versions granularly per group.

 

If we wanted to get even more granular and apply these per room, but still keep the overall 'main' policy, which would take precedence?

 

https://serverfault.com/questions/521180/what-takes-precedence-when-multiple-conflicting-gpos-apply-to-the-same-ou

 

So say in this scenario we wanted 'Art' to have 24H2, would the system respect 22H2 from the 'Student PC' container and then apply 24H2 to the Art container? Or would the top GPO override the 'lower' container?

 

I think this would work, but wanted to see if I'm overthinking things!

 

[jthompson]

If you had a GPO setting the 'Select the target Feature Update version' option to 24H2 and linked that GPO to the Art OU, that would win over the 'Select the target Feature Update version' option of 22H2 in the 'W10 Student PC - WUFB' GPO linked to the OU higher up. Other options in the 'W10 Student PC - WUFB' GPO would still get applied, provided those options aren't set in GPOs linked closer to the computers in AD.

 

If you've got competing option in GPOs linked at the same level, you need to ensure that the inheritance order of those linked GPOs is shuffled to your needs (I can never remember if a lower number in th inheritance order wins over higher numbers, or the other way around).

[CHiLL]

GPOs work on last policy wins, where GPOs at the OU level the computer/user is in takes precedent over GPOs specified higher up in the structure, such as at the root of the domain. If you have a GPO setting set as "Enabled" at the root of your domain and the same setting specified as "Disabled" in the sub-OU containing your user/computer object, the sub-OU GPO will win and the setting will be "Disabled".

 

As @jthompson said, if you have two GPOs at the same level, both configuring the same option but one is set as "Enabled" and the other set as "Disabled", then which one wins is determined by the order of precedence specified on those GPOs (I also can't remember whether a higher or lower number determines priority).