An Active Directory Object that contains settings for implementing Group Policy in Active Directory.
These settings can be applied to both users and computer objects.
Every GPO has a unique name and is assigned a Global Unique Identifier (GUID).
They can be linked to a specific OU, Domain, or site. A single GPO can be linked to multiple Container, and any container can have multiple GPOs applied to it.
Order of Precedence
Policies are loaded in the following order:
- Local Security Policy
- Site Policy
- Domain Policy
- Parent OU Policy
- Child OU Policy
Policies loaded later takes precedence over those loaded earlier because they will override conflicting earlier loaded policies.
When more than one GPO is linked to an OU, they are processed based on the Link Order. The GPO with the lowest Link Order is processed last, thus the GPO with link order 1 has the highest precedence, then 2, and 3, and so on.
If the Enforced option (No Override in early versions) is set, then policy settings in GPOs linked to lower OUs cannot override the settings.
If the Block Inheritance option is set for a particular OU, then policies higher up will not be applied to this OU. If both Block Inheritance and Enforced options are set, the Enforced option takes precedence.
Policy Refresh Frequency
When new GPOs are created the policies are not applied right away. Windows performs Group Policy updates periodically. The default period is every 5 minutes for Domain Controllers and 90 minutes with a randomised offset of +/- 30 minutes for Users and Computers. The offset is to distribute client requests.
These defaults can be changed by clicking Computer Configuration —> Policies —> Administrative Templates —> System —> Group Policy and selecting Set Group Policy refresh interval for computers.
One can also force the update with gpupdate /force.