Why would inherited permissions be blocked at default domain level?

[speckytecky]

As seems pretty standard with most other Primary Schools we have server performing most tasks (apart from SIMS) as a curriculum server. Looking at the GPO recently I was puzzled to see a blue exclamation mark against the default domain policy and see it's because the block inherited permissions has been ticked.

I think this has happened by accident but in case not wondered what circumstances would make it appropriate to have it ticked?

[speckytecky]

Bump, bump!

[SYNACK]

If I am thinking of the right setting then it blocks inheritance of any policy objects above it in the domain tree. As it is the top level object I don't think that it would actually have any affect. Not 100% on this but one reason to tick it would be if your domain was part of a larger domain forrest and you wanted to apply your own individual policies without the interfearence from forest wide policies.

[speckytecky]

That makes sense Synack. Thanks very much.