Special Edition Using Microsoft Active Directory

Group Policy Security and Inheritance

After you have created and applied group policy, you inevitably will want to delegate management to other administrators, make exceptions to group policies, and troubleshoot group policy application. In this section, you take a look at group policy security and how it is inherited throughout the domain.

The first and most basic rule is that group policy flows down the tree. The second is that any group policy close to you overrides any group policy farther away. If you are a member of a container object, a site, a domain, or an OU that either has group policy assigned to it or is below a container object that has group policy assigned, you will inherit that group policy. If conflicts exist between group policy ...