MCSA/MCSE Self-Paced Training Kit (Exam 70-270): Installing ...

!
Lesson 1 Overview of Security Policy
16-11
Exam Tip An easy way to remember the order in which GPOs are processed is that first the
local GPO is processed, and then Active Directory GPOs are processed. Active Directory GPOs
are processed starting with the farthest structure from the user (the site), then the next
closer structure to the user (the domain), and finally the closest structure (the OU). You can
also use the acronym LSDOU (local, site, domain, organizational unit) to help you remember.
Note Administrators can configure the order in which GPOs are applied if multiple GPOs
exist for a site, domain, or OU. In addition, administrators can control whether GPOs from
higher levels are overridden or not, which might affect how GPOs are processed.
How Group Policy Is Applied
Obviously, processing policies when a user logs on is a pretty complicated endeavor.
After all, a large number of GPOs might be linked (either directly or through inheritance)
to the computer that a user is logging on to and to the user account being logged
on with. The following steps describe how Group Policy is applied when a computer
that is part of Active Directory starts and a user logs on.
1. During startup, the computer obtains an ordered list of GPOs, based on whether
the computer is a member of Active Directory or not. If not, only the local GPO is
processed. If the computer is a member of Active Directory, the list of GPOs to
process is based on the Active Directory structure and inheritance, as discussed in
the preceding sections.
2. If the GPOs linked to the computer have not changed since the last time the computer
started, no processing is done. If the GPOs have changed, they are all processed
again.
3. The computer applies any Computer Configuration settings, which occurs in the
familiar order: local, site, domain, OU.
4. Startup scripts specified by any GPOs now run. Each script must complete or time
out before the next script begins.
5. The logon screen is displayed to the user. The user presses CTRL+ALT+DEL and
enters credentials to log on to the network.
6. Once the user is authenticated, the computer loads the user profile (which is governed
by the GPOs in effect).
7. The computer receives an ordered list of GPOs that are linked to the user. Again,
if no GPOs have changed since the last time the user logged on, no processing is
done. If the GPOs have changed, they are all processed again.