Undoing a GPO setting

[garethedmondson]

Just a quick question - if the LEA set a GPO option at the top of an OU can I then undo that setting my putting in place my own GPO and setting it to 'disabled'?

 

CHeers

 

Gareth

[FN-GM]

If you set the group policy object to disabled it will not apply. As far as the computers or users are concerned it does not exist.

[garethedmondson]

Yes I know that but I cannot disable domain wide GPO's as they apply to other schools as well. So I was wondering if my GPO would overwrite the LEA GPO.

 

Gareth

[ChrisH]

It should work but sometimes it depends on the setting. Some settings may have to be set to something else to get rid.

[glennda]

You may find that the local machines ignore the policy which you put in as it is conflicting with a GPO higher up.

 

If multiple GPOs attempt to set a setting to conflicting values, the GPO with the highest precedence sets the setting. GPO processing is based on a last writer wins model, and GPOs that are processed later have precedence over GPOs that are processed sooner. Group Policy objects are processed according to the following order:

 

The local Group Policy object (LPGO) is applied.

 

GPOs linked to sites.

 

GPOs linked to domains

 

GPOs linked to organizational units. In the case of nested organizational units, GPOs associated with parent organizational units are processed prior to GPOs associated with child organizational units.

 

Source: Managing inheritance of Group Policy: Group Policy

[FN-GM]

It will merge the settings from yours and the LEA one.

 

You could create a sub OU and disable inheritance. Again this will not apply any settings and machines and users will act asif it inst there.

[michaelf]

If multiple GPOs attempt to set a setting to conflicting values, the GPO with the highest precedence sets the setting. GPO processing is based on a last writer wins model, and GPOs that are processed later have precedence over GPOs that are processed sooner. Group Policy objects are processed according to the following order:

 

The local Group Policy object (LPGO) is applied.

 

GPOs linked to sites.

 

GPOs linked to domains

 

GPOs linked to organizational units. In the case of nested organizational units, GPOs associated with parent organizational units are processed prior to GPOs associated with child organizational units.

 

Source: Managing inheritance of Group Policy: Group Policy

 

If I'm reading that correctly it would suggest that GPO's lower down the chain have priority, and that as such yes a GPO applied to a sub OU (your own GPO) would overwrite those higher above it (your LEA's). So in other words yes it would.

[glennda]

If I'm reading that correctly it would suggest that GPO's lower down the chain have priority, and that as such yes a GPO applied to a sub OU (your own GPO) would overwrite those higher above it (your LEA's). So in other words yes it would.

 

It doesn't say they have priority they are just process by the machine later.Although this is supposed to happen i know many instances when a gpo higher in the tree is applied and the lower one tries to apply and fails.

For example on a single site the Default Domain Policy is applied first as it is at the top of the tree but if you say set an active desktop in this - then try to set a different one lower down on a seperate ou you may find the client either ignores it or does not apply that setting.

 

It's not what microsoft say should happen but in my experience it does!

 

Toby

[Hightower]

Just did my 70-270 training the other week and the way to remember this is with drugs - LSD

 

L - Local

S - Site

D - Domain

OU - Organisational Units

 

Basically the local policy is applied which is then overwritten by any site policies which is then overwritten by any domain policies.

[garethedmondson]

Thanks everyone. Further advice given away from Edugeek is to choose the 'Enforce' option for the GPO. This will force any setting change for the GPO regardless of what was set higher.

 

Cheers

 

GJE