11

If two or more GPOs are applied to the same OU (and they have contradictory policies), which would be applied?

For example, if there is a GPO with the computer policy "Enable autoplay on all drives" set to "enabled" in one GPO, and "disabled" in another GPO, and they are both applied to the same computer OU... which would take precedence?

Austin ''Danger'' Powers
  • 1,180
  • 6
  • 21
  • 51

1 Answers1

16

GPOs have a link order for just this sort of thing.

"Links to a specific site, domain, or organizational unit are applied in reverse sequence based on link order. For example, a GPO with Link Order 1 has highest precedence over other GPOs linked to that container."

http://technet.microsoft.com/en-us/library/cc757050(v=WS.10).aspx

Ryan Ries
  • 55,481
  • 10
  • 142
  • 199
  • So, to clarify, whichever one is applied last in the link order except for when a policy that has the "No Override" option set. – Rex Jul 05 '13 at 22:06
  • 6
    It's known as "Enforced" these days. Setting a GPO to enforced effectively moves it to the end of the processing order, meaning it always wins. If you have multiple conflicting Enforced GPOs they go in reverse order. (The 'higher' one in the OU structure wins,) But if it ever got that complex, you would need to rethink your overall GPO strategy in my opinion. – Ryan Ries Jul 05 '13 at 22:17
  • Call me old school. :) I know it's called enforced now but I was quoting from the technet link you posted. Didn't want to confuse the poor soul with enforced vs no override – Rex Jul 05 '13 at 22:20
  • I already know "enforced" is the new "no override". We have an SBS 2003 server and even that has "enforced", so it must have been this way for at least a decade. – Austin ''Danger'' Powers Jul 05 '13 at 22:51