Name: MCITP 70-640: Enforcing and Blocking Group Policy
Uploaded: 2015-05-01T03:16:38.000Z
Duration: 17 min 34 s
Description: Thousands of YouTube videos with English-Chinese subtitles! Now you can learn to understand native speakers, expand your vocabulary, and improve your pronunciation...

This video will look at the Group Policy settings enforced and blocked. By the end of the video

Adverbs of manner

you will be able to not only understand how to enforce and block Group Policy, but also

have a better understanding of how to effectively deploy Group Policy in a hierarchy that matches

the needs of your business. To review what we have covered in the previous

videos, a computer will obtain an ordered list of Group Policy and apply it to the computer

in that order. First of all Group Policy is retrieved

from the local computer. This will be the first Group Policy to be processed. The rest

of the Group Policies are retrieved from the domain. These are sorted so that they are

in the order of Site, Domain, OU’s followed by child OU’s.

In some cases you may have multiple Group Policies linked at the same level in Active

Directory. In this example there are two Group Policies linked at the domain level.

If I open Group Policy Management and make sure the domain is selected, notice that there

are two Group Polices linked at the domain level.

On the right hand side, notice there is a link order for each of the Group Polices.

The Link Order determines the order in which the Group Policies will be applied when there

is more than one. The Group Policy with a high link number will take preference over

the other Group Policy. For this reason, they are processed in the reverse order.

To understand why, if I go back to the diagram, notice what happens if I add the link numbers

to the Group Policy diagram. The Domain Group Policy with Link Order 2 will be applied first.

After this, the Domain Group Policy with the Link Order 1 is applied next. This means the

Group Policy with the Link Order 1 will overwrite any settings applied from the Group Policy

with Link Order 2. It may seem a bit confusing which order Group

Policy is applied first, but if you think of higher priority Group Policy needs to overwrite

lower priority it makes sense that Group Policy with a lower priority must be processed first.

This is why local Group Policy is applied first. Local Group Policy has the lowest priority

and thus any other Group Policies that have been applied have the capacity to overwrite

any settings that are configured in the local Group Policy.

In most situations, this works well, but let us consider a situation where this can cause

problems. If you had a testing computer or a kiosk computer you may want the computer

configured a certain way. Let us consider a Group Policy which configures the wallpaper

and the Windows Firewall. The result will be that the wallpaper and Windows Firewall

will be configured on the client computer. Now consider that a second Group Policy is

created which changes the wallpaper. Notice how the firewall settings have been kept.

To make sure firewall settings do not get applied from the previous Group Policy you

would need to configure the firewall settings in the second Group Policy. These settings

would replace the original settings. This works well when you first configure

Group Policy, but let’s say later on additional Group Policy settings were configured, in

this case a wireless setting. If you had a computer configured as a kiosk for example,

you may not want new group policy settings appearing on the computer.

To get around this problem, Group Policy allows an option to be configured called Block Inheritance.

This setting is configured at the OU level. As shown here, there are four OU’s that

will be processed in order. If blocked Inheritance was to be applied on the second OU, notice

that now the Group Policy before this is no longer applied.

Blocking Inheritance will allow you to have a clean slate, so to speak. Configuring Block

Inheritance allows you to configure the Group Policy setting for an OU without having to

worry about any settings that are applied above it.

Notice also that the OU under the blocked OU, the third OU, is able to inherit the settings

from the above OU. Blocking inheritance will prevent any settings configured previously

from being applied, but will not prevent any settings after this from being applied.

In some cases an administrator may have settings that they want all computers to have. They

do not want an administrator to have the option to block settings that they have configured.

To allow this, Group Policy has the option to enforce settings. The enforce setting option

can be configured per Group Policy, unlike block inheritance which is configured per

OU. To understand how Enforced works, consider

a typical list of Group Policy settings that are waiting to be applied. These are in the

order of Local, Site, Domain and OU’s. At the domain level there are two Group Policies.

The second Group Policy will be applied first so the first Group Policy overrides any settings

it configures. Now like before, let’s say an administrator

on one of the OU’s, configures the OU to Block Inheritance. As before, the previous

OU’s will not be applied. If you plan to enforce a Group Policy, it

is best to create a Group Policy that contains settings that you only want to enforce. Settings

that you are not too worried about being overwritten should be put into a different Group Policy.

Notice that when the domain Group Policy is set to enforce it is moved to the end of the

processing order. Since this Group Policy is being applied last now, this means that

it will override any other settings configured before this.

You may be wondering what would happen if an OU was configured to Enforce. Would this

OU now override the settings configured by the Enforced Group Policy at the domain level?

The answer is no. Notice that if an OU is configured with enforce , once again this

Group Policy will be moved to the end but will be processed before the Enforced Domain

Group Policy. This ensures that an enforce OU does not override a group Policy Enforce

at the domain. Notice also, that if the Group Policy were

enforced at the site level, the site Group Policy would also be moved to the end but

would be the last Group Policy to be applied. In other words, any enforced Group Polices

are applied in the order OU’s, Domain and Site. This is the reverse order that they

would be applied in if they were not enforced. This ensures that the when Group Policy Settings

are enforced the Group Policy setting are still applied in the correct hierarchical

order. Now that you understand how the Group Policy

order is determined, let us now have a look at how this works with the user and computer

side of group Policy. As shown here, when the computer starts up

the Group Policy is obtained from the local computer and domain and then sorted so that

it can be processed. All the settings found in the computer side of the Group Policies

are applied when the computer starts up. These are in the order shown.

When a user logs in, the user side of Group Policy is applied in the same order that the

computer side was applied in. This allows the user side of Group Policy to override

what was applied in the Computer side of Group Policy. There are not that many Group Policy

settings that overlap between the User and Computer side, so any occurrence of Computer

Side settings overwriting User Side settings should be rare.

I will now change to my Windows Server 2008 R2 Domain Controller to have a look at how

to configure the Block Inheritance and enforce options in Group Policy.

If you have watched our previous videos on Group Policy, you will remember we created

a Group Policy at the Domain Level that configured the desktop wallpaper for all users in the

domain. You can see that the wallpaper on this Domain Controller is currently being

set from this Group Policy, settings configured for the user do not effecting servers like

Domain Controllers. To fix this problem, I will use block Inheritance.

To configure it, open Group Policy Management from administrative tools under the start

menu. At the top, you can see the Domain Wide Group Policy. This Group Policy was originally

created to configure settings for users and computers, so should not be apply to Domain

Controllers. To prevent this from happening, it is a simple

matter of selecting the Domain Controller OU, right clicking it, and then selecting

the option Block Inheritance. Notice that when I select this option the icon for the