Active Directory Domain Services 2008 : Block & Remove Block Inheritance of Group Policy Objects, Change the Order of Group Policy Object Links

Block Inheritance of Group Policy Objects

Scenario/Problem: You need to prevent GPO settings defined in a GPO linked to the parent OU from being inherited to servers in a child OU.

Solution: Block inheritance of GPOs.

To block inheritance of a GPO, perform the following steps:

1.	Log on to a domain controller or a member computer that has Windows Server 2008 RSAT installed.
2.	Click Start, click Administrative Tools, and then click Group Policy Management.
3.	In the console tree, select the site, domain, or OU on which you want to block inheritance, and click Block Inheritance.
4.	Ensure there is a check next to Block Inheritance, as shown in Figure 1. Figure 1. Blocking the inheritance of GPOs.

Remove Block Inheritance of Group Policy Objects

Scenario/Problem: You previously enabled block inheritance of GPOs. You no longer require this.

Solution: Remove block inheritance of GPOs.

To remove block inheritance of a GPO, perform the following steps:

1.	Log on to a domain controller or a member computer that has Windows Server 2008 RSAT installed.
2.	Click Start, click Administrative Tools, and then click Group Policy Management.
3.	In the console tree, select the site, domain, or OU from which you want to remove block inheritance, and click Block Inheritance.
4.	Ensure there is not a check next to Block Inheritance, as shown in Figure 2. Figure 2. Removing the block inheritance of GPOs.

Change the Order of Group Policy Object Links

Scenario/Problem: You have multiple GPOs that are linked to an OU. You need to ensure one of these GPOs is applied last.

Solution: Change the link order of GPO links.

To change the order of GPO links, perform the following steps:

1.	Log on to a domain controller or a member computer that has Windows Server 2008 RSAT installed.
2.	Click Start, click Administrative Tools, and then click Group Policy Management.
3.	In the console tree, select the site, domain, or OU for which you want to change the link order.
4.	In the details pane, select the GPO for which you want to change the link order and use the arrows on the left side of the details pane to move the GPO higher or lower in order, as shown in Figure 3. Figure 3. Changing the order of GPO links.