7
2.3
Organizational Unit (OU) and Group Policy Objects (GPOs) Design
An organizational unit (OU) is a container within a domain which contain specific access control list
(ACL) permissions to devices and items that it can access and /or control. OUs provide
administrators an easy way to group users and other security principals together while effectively
creating segment administrative boundaries within their domains and forests. Administrators can then
use group policy and delegate administration by applying specific settings, rights, and behaviors to
all servers, devices, users, and groups within an OU. By using group policy rather than manual
steps, it is simple to update a number of servers with any additional changes required in the future.
Figure 2.
Group policies are accumulated and applied in the order shown in the illustration below.
As seen above, policies are applied first from the local machine policy level of the computer. After
that, any GPOs are applied at the site level, and then at the domain level. If the server is nested in
several OUs, GPOs existing at the highest level OU are applied first. The process of applying GPOs
continues down the OU hierarchy. The final GPO to be applied is at the child OU level containing the
server object. The order of precedence for processing Group Policy extends from the highest OU
(farthest from the user or computer account) to the lowest OU (that actually contains the user or
computer account).
The following rules must be observed when applying Group Policy:
•
GPO application ordering for group policy levels must be set within multiple GPOs. If
multiple policies specify the same option, the last one applied will take precedence.
•
Configuring a Group Policy with the
No Override
option prevents other GPOs from overriding
it.