Florian
Sat Sep 06 00:40:28 PDT 2008
Dan,
Dan wrote:
> I just did a bit of testing and to my surprise saw that GP's can be
> cumulative. For example, I have a top level OU and a child OU and applied
> two separate policies (one to each OU). In the policies I set user level
> favorites in IE.
> For a user located in the child OU they saw all of the favorites from both
> policies applied which surprised me. I thought they'd see only the favorites
> specified in the policy set on the child OU. Is this true generally in GP's
> that multi value fields (not enabled vs. disabled) are cumulative? Is the IE
> stuff a one off? Does it differ from CPU to user settings?
That's a general feature of Group Policy. Group Policy gets applied in
the following order:
local policies (from the local machine) - sites policies - policies
linked to the domain root - first level OU - second level OU - third
level OU - ...
All policies along the way down to the actual position of the target
object in the directory get applied. Settings that contradict each other
(say first level OU has "enabled", third level OU has the same settings
"disabled") have the "later" setting applied. That's a "last writer
wins" approach so to speak.
Not sure what you mean by "Does it differ from CPU to user settings"? If
you mean to ask if there's a difference between the computer config
settings and the user config settings regarding the processing, then no.
Computer config settings are applied the same way and are "cumulative", too.
cheers,
Florian
--
Microsoft MVP - Group Policy
eMail: prename [at] frickelsoft [dot] net.
blog:
http://www.frickelsoft.net/blog.
Maillist (german):
http://frickelsoft.net/cms/index.php?page=mailingliste