Which GPO setting apply first Domain Level or OU level?

We are a small company that has a few GPOs at the domain level with some settings applied. We have some GPOs at the OU level with some settings applied. The Domain GPO has a higher link-level (15) and its settings are applied first. The GPO for the OU has a link level of 1, and it applied last.

We most of us believe that since the GPO at the OU level is applied last, if it has a setting that is the same as was set in the domain GPO -i.e., domain password expiration is 90 days and the OU GPO password expiration is 120 days, that the OU GPO setting of 120 days would apply. However, that is not what I am seeing.

Is this normal behavior that the first GPO that applies a setting is what takes effect? What is a GPO at the domain level has a setting and the GPO at the OU level is blank or not set?

Many Thanks.

1 Like

Hello @the_joe

Group policy apply order is
1 system local policy->Site policy–>Domain policy–>OU
In short LS D O U
It means first of all local policy apply on System then site Policy if configured -->Domain Policy then OU policy.

In Password policy if you want to configure specific password policy for specific user or group as you mentioned you will have to configured fine grained password policy

But in other group policy settings settings you can use the following steps

for example if you want to configure disable contol panel for domain policy(navigate to Control panel select (prohibit access to Contol panel and PC settings) and click on enable it will apply to all network users including administrator and including all OUs but if you want to enable control panel for specific OU then you will have to create new GPO in specific OU then nevigate to Control panel (prohibit access to Contol panel and PC settings) and select disable option i n OU policy.
after this control panel would be enable for the same OU

Note: Select Enable setting in domain and Select disable in OU for the same policy.

If you have any doubt feel free to contact me.

1 Like