The book information is wrong

[Johnny Chow]

I am newbie. Please correct me if am wrong, I saw the book "If the no
override option is selected for each GPO link, then the setting contained in
your audit policy GPO will be given a higher priority than other GPOs that
do not have the NO override option selected. However, if another GPO
conflicting setting also has the NO override option selected then the GPO
that is closest to the container will apply"

I did a test with no override settig on both domain group (enable) and ou
group polices (disable) with "disable display in control panel" then domain
group policy wins (enable) but not "closest to the container will apply" in
this case.

Any info will be appreciated.

 

[Laura E. Hunter \(MVP\)]

Multiple GPOs with the "no override" setting will the usual processing order
of GPOs. The normal processing order goes:

Local
Site
Domain
OU:
- Parent OU
- Child OU
- "Grandchild" OU
and so forth. Conflicting settings are managed in a "last setting applied
is the one that wins" fashion.

If, for example, there is a GPO applied to the Parent OU, and a conflicting
one applied to the Child OU, then the Child OU GPO settings would be
applied, since it would be applied last.

"No override" changes this a bit. If, in our last example, there is a GPO
applied to the Parent OU with the "no override" option, and a conflicting
setting existed in the GPO applied to the Child OU, then in this case the
PARENT OU setting would be applied because of the "no override" option.

-Multiple- "no override" settings get even more convoluted. In a case where
there are multiple GPOs with "no override", then the FIRST GPO applied is
the one that wins, not the last.

So if the Parent OU had a GPO with No Override, and the Child OU -also- had
a GPO with No Override, then the PARENT would win, since its No Override
setting is processed before that of the Child OU GPO.

 

[Johnny Chow]

Thank you for clearing out my confusions, you are better than books.