MCSA/MCSE Self-Paced Training Kit (Exam 70-270): Installing ...

16-10 Chapter 16 Configuring Security Settings and Internet Options
Note This chapter does not cover how to create and apply GPOs because this topic is out
of scope for this book and the exam it covers. Instead, this chapter covers how GPOs interact
with and affect LGPOs.
Additional Settings That You Can Configure by Using Group Policy
You can use Group Policy to configure any of the settings that you can configure with
Local Security Policy. In addition, you can also use Group Policy to do the following:
■ Install software and software updates on desktop computers throughout an Active
Directory network.
■ Redirect special folders (such as users’ My Documents folders) to a network location.
■ Configure Remote Installation Services (RIS) options.
How Multiple Policies Are Combined
In an Active Directory environment, GPOs can come from different sources to apply to
a single user or computer. For example, a computer might be a member of a domain,
a site, and two levels of OUs. Each of them might have a GPO associated with it, meaning
that four GPOs would affect the computer. In addition, the computer might have an
LGPO in effect. There must be a way of determining how those GPOs and LGPOs are
combined. GPOs and LGPOs are processed in the following order on a computer running
Windows XP Professional.
1. The LGPO on the computer is processed, and all settings specified in that LGPO
are applied.
2. Any GPOs that have been linked with the site in which the computer resides are
processed. Settings made at this level override any conflicting settings made at the
preceding level. For example, if the local GPO specifies that a computer does not
have access to a printer, and a site GPO specifies that the computer does have
access, the site GPO “wins.”
3. GPOs linked to the domain in which the computer resides are processed, and any
settings are applied. Settings made at the domain level override conflicting settings
applied at the local or site level.
4. GPOs linked to any OUs that contain the user or computer object are processed.
Settings made at the OU level override conflicting settings applied at the domain,
local, or site level. It is possible for a single object to be in multiple OUs. In this
case, GPOs linked to the highest level OU in the Active Directory hierarchy are
processed first, followed by the next-highest level OU, and so on. If multiple
GPOs are linked to a single OU, the administrator gets to specify the order in
which they are processed.