How Gpos Are Applied

By Author: kennie
Total Articles: 129
Comment this article

Group policies are collections of user and computer configuration settings MCTS benefits that can be linked to computers, sites, domains, and OUs to specify the behavior of users' desktops. For example, using group policies, you can set the programs that are available to users, the programs that appear on the user's desktop, and Start menu options.
To create a specific desktop configuration for a particular group of users, you create Group Policy Objects (GPOs). GPOs are collections of Group Policy settings. Each computer running Windows Server 2003 has one local GPO and might, in addition, be subject to any number of nonlocal (Active Directory-based) GPOs. Local GPOs are overridden by nonlocal GPOs. Nonlocal GPOs are linked to Active Directory objects (sites, domains, or OUs). Nonlocal GPOs can be applied to either users (regardless of which computer they log on to) or computers (regardless of who logs on to them). Following the inheritance properties of Active Directory, nonlocal GPOs are applied hierarchically from the least restrictive group (site) to the most restrictive group ...
... (OU) and are cumulative.
Because nonlocal GPOs are applied hierarchically, the user or computer's configuration is a result of the 70-620 exam cost linked to its site, domain, and OU. GPOs are applied in the following order:
Each server running Windows Server 2003 has exactly one GPO stored locally.
Any GPOs that have been linked to the site are applied next. GPO application is synchronous; the administrator specifies the order of GPOs linked to a site.
Multiple domain-linked GPOs are applied synchronously; the administrator specifies the order of GPOs linked to a domain.
GPOs linked to the OU highest in the Active Directory hierarchy are applied first, followed by GPOs linked to its child OU, and so on.
Finally, the GPOs linked to the OU that contains the user or computer are applied.
At the level of each OU in the Active Directory hierarchy, one, many, or no GPOs can be linked. If several group policies are linked to an OU, then they are applied synchronously in an order specified by the administrator.
Because Active Directory is an LDAP-compliant directory service, network clients use LDAP to query the Active Directory database. Every object in Active Directory is identified by a name, and LDAP standards determine how the objects are named. Active Directory uses a variety of object naming conventions: distinguished names, relative distinguished names, globally unique free Microsoft practice exam questions identifiers, and user principal names.