Dear Group,

I could certainly use and explanation for this one. This afternoon I
imported a custom template into a GPO and linked the GPO to an OU
using The Group Policy Managment Console. The only other GPO in the
ADUC was the default domain policy. The GPO didn't work until I
selected "Enforce" (Otherwise "No Override" without the GPMC.msi
installed)

The question is... Why do I have to use the "Enforce" if it's the last
GPO to get processed.? If anything their should be a "No Inheritance"
option. Domain level GPO gets processed before the OU level GPO and
the Domain GPO doesn't have "Enforce" or "No Override" set so why the
"Enforce" on the OU GPO?

Thanks,
Keeper

Hi,

It may depend on how the Custom ADM was written. Is it written for the
"policy" section of the registry or to actually change the registry itself
like the older NT adm's did?

Cheers

Lara

"Keeper" wrote:

> Dear Group,
>
> I could certainly use and explanation for this one. This afternoon I
> imported a custom template into a GPO and linked the GPO to an OU
> using The Group Policy Managment Console. The only other GPO in the
> ADUC was the default domain policy. The GPO didn't work until I
> selected "Enforce" (Otherwise "No Override" without the GPMC.msi
> installed)
>
> The question is... Why do I have to use the "Enforce" if it's the last
> GPO to get processed.? If anything their should be a "No Inheritance"
> option. Domain level GPO gets processed before the OU level GPO and
> the Domain GPO doesn't have "Enforce" or "No Override" set so why the
> "Enforce" on the OU GPO?
>
> Thanks,
> Keeper
>