Linking Group Policys - What order and what options?

[Nick_Parker]

Hi Guys,

 

I know this probably rather simple but I'd just like to make sure I understand it.

 

When linking group policies, I have 2 Group Policys:

 

1 -> Default Domain Policy

2 -> Internet Settings Group Policy

 

(The numbers are the link order)

Default domain policy sets the proxy to 192.168.0.40:8080

Internet Settings Group Policy sets the proxy to 192.168.0.45:8080

 

Now, when the policys are applied, what will the clients proxy settings be set to? I would assume it would be set to 192.168.0.40 and then changed to 192.168.0.45 almost straight away as it loads Default GP and then the Internet one directly after?

 

Next question, how does the Enforced option affect the GPs?

If the 1st one is enforced, can the 2nd one override the settings?

what if the 2nd one is set to enforce? what if they both are?

 

Sorry, like I said, probably a simple answer

[altecsole]

Policies will be applied from the bottom up; so you will end up with 192.168.0.40:8080.

 

If a policy is enforced policies that apply after it cannot change any of the settings that it applied. If you have two policies, both enforced and both with the same settings, I'd look again at your setup and see if you can change things around.

[Nick_Parker]

Thanks so much altecsole

[browolf]

if you install or use group policy management console , you can run tests that simulate policy application and u get a report telling u what settings have been applied (from where iirc)

[tosh74]

Policies will be applied from the bottom up; so you will end up with 192.168.0.40:8080.

 

If a policy is enforced policies that apply after it cannot change any of the settings that it applied. If you have two policies, both enforced and both with the same settings, I'd look again at your setup and see if you can change things around.

 

Wrong way round mate. GPO are applied in the following order

Local policy

Site-level policy

Domain-level policy

Domain controller policy (if the domain controller is left in the domain controller container)

Organizational unit policy

[ricki]

What I would do is

 

Leave the default domain policy where it is and link you internet setting policy to the ous that it must work with. So for example you might want all your xp clients that are in on ou to have a different proxy than the default. Linking the policy will apply the default domain policy and then the internet policy to the computers in that ou. This works as long as you dont enforce a policy lower down.

 

Richard

[srochford]

Wrong way round mate. GPO are applied in the following order

Local policy

Site-level policy

Domain-level policy

Domain controller policy (if the domain controller is left in the domain controller container)

Organizational unit policy

 

Yes, but if you have multiple policies linked at the same level (eg 2 linked at the top of the domain; 2 linked to the same OU) then they apply in reverse numerical order (which is *really* stupid!)

 

The best thing to do is run the RSoP as pointed out by @browolf - then you can be sure what's going to happen.

[altecsole]

Wrong way round mate.

 

Sorry mate; the original post mentioned link order; this applies to group policies applied in the same OU. In this case the policies are applied from the bottom up (2 first, then 1).

[altecsole]

GPO are applied in the following order

Local policy

Site-level policy

Domain-level policy

Domain controller policy (if the domain controller is left in the domain controller container)

Organizational unit policy

 

This is wrong. Policies cascade down from Site, Domain, OU, Sub OU etc. When a policy is set at one level, the levels below inherit the settings from the levels above. If a policy settings collide, the last policy applied wins (unless you have Block Inheritance set).

[powdarrmonkey]

If a policy settings collide, the last policy applied wins (unless you have Block Inheritance set).

 

Or the policy object is marked Enforced, in which case it wins over policies that would otherwise override it.

[tosh74]

Sorry mate; the original post mentioned link order; this applies to group policies applied in the same OU. In this case the policies are applied from the bottom up (2 first, then 1).

 

aye helps if I READ the OP correctly (missed the link order)