MCITP 70-640: Enforcing and Blocking Group Policy

This video will look at using the Group Policy options block and enforce. These options allow you to change the way Group Policy is processed in your domain; however this does make things more complex. This video also looks at ways that Group Policy can be deployed to minimize the need for enforce and blocking Group Policy.

Group Policy Processing
Group Policy is processed in the following order: local, site, domain, OU. If there are multiple Group Policies applied to the same OU, a link order is used to determine which Group Policy will have preference over the other. A Group Policy with a lower link order number takes priority over a Group Policy with a higher link order. For this reason, the Group Polices will be applied from highest link order or lowest link order.

Blocking Group Policy is useful when you have multiple Group Polices and you do not want settings to be inherited. Without the blocking option, you need to reverse any Group Policy settings applied previously. The problem when blocking is not used is that settings can be added later on. The administrator would need to reverse the new Group Policy settings later on if they did not want them.

Block Inheritance
Block inheritance is configured at the OU level. Once configured it blocks all the settings configured by Group Policy above it. This allows the administrator to start again without having to worry about what settings have already been configured.

Enforced
Individual Group Polices can be configured with the enforce option. This will ensure that the settings in the Group Policy are applied even if an OU is configured to block inheritance. To achieve this, the Group Policy with the enforce option is moved to the end of the processing order. In other words the processing order goes like this: local, site, domain, OU's and then enforced Group Polices in the order of OU's, domain and then site. In other words, the enforced Group Polices are moved to the end and applied in the reverse order that they would normally be applied in.

Group Policy Processing
The computer side of Group Policy is applied when the computer starts up. The user side of Group Policy is applied when the user logs in. This means that the user side of Group Policy will overwrite the computer side of Group Policy if there is a conflict. There are very few Group Policy settings that have the same name in the computer and user side of group policy. For this reason it is rare to have conflicts.

Demonstration
To block inheritance on an OU, right click the OU in Group Policy Management and select the option Block Inheritance.
To enforce a Group Policy, right click on the Group Policy and select the option Enforced.
It is recommended that you use the block and enforce options only when required. In a lot of cases you can avoid using these options by careful planning of your Group Policies.

References
"MCTS 70-640 Configuring Windows Server 2008 Active Directory Second Edition" pg 292-294

[itfreetraining]

Yes we are. The video in development can also be accessed of the web site if you do not want to wait for them to be released on YouTube.

[itfreetraining]

Glad you like the video. I think you are referring to the enforce option as the break inheritance option. That's pretty creative. We may use that is a later video if you don't mind.

[itfreetraining]

No problem at all, thanks for watching.

[itfreetraining]

Glad you like the video. We have some clustering videos in the 70-643 course. At this stage we will not be doing any Exchange videos. We do not have the resources to do so.

[itfreetraining]

You can only block inheritance at the OU level. By the sounds of it, you can achieve the results that you want by settings the permissions of the group policy object. Remember that to apply a group policy the user or computer require read and apply group policy permission. If you remove this or deny these, they can not longer apply the group policy.

[Remolhunter]

Thank you so much boss, haven't found any documentation online explaining this concept easily or completly <3

[manas]

Thank you very much Sir for sharing such a wonderful knoweledge.I am really Glad to have you as my trainer. Can we see such more videos coming for exchange 2010, Clustering etc as well. Thanks once again for all the good work !

[kanish]

chanceless sir.. everything of ur videos are useful

[AbdulHameed-revo]

batter than any other training materials.

[freshitbrain]

Thanks to explain it in quite good way!

[mkhlafa]

I enjoyed your video. Learned a lot. a huge THANK YOU!!

[gjkristi]

Great tutorials, helps me a lot towards cerftification exam!