GPO Scope and Inheritance

Linking a GPO to a container determines the broad population of computers and users it can reach, but three additional mechanisms narrow that scope further: security filtering, WMI filtering, and item-level targeting inside Group Policy Preferences. Security filtering restricts a linked GPO so it only applies to security principals (users, computers, or groups) that have both Read and Apply Group Policy permissions on the GPO; by default, Authenticated Users has both, so removing that entry and adding a specific security group is the standard way to target a subset of an OU. WMI filtering goes further by evaluating a WQL query against each machine at processing time, applying the GPO only if the query returns true, which is useful for targeting by OS version, disk space, or hardware attributes rather than group membership.

By default, GPOs linked higher in the hierarchy flow down to child OUs, but Block Inheritance can be set on an OU to stop GPOs linked above it (at the domain or a parent OU) from applying to objects inside it. Block Inheritance is an all-or-nothing switch on the OU itself, not on individual GPOs. The Enforced flag, set on a specific GPO link, overrides Block Inheritance for that one link and also wins any conflict against a closer, non-enforced GPO, meaning an enforced domain-level policy will apply even to an OU that has Block Inheritance turned on. This combination lets security teams guarantee that critical baseline settings, like a minimum password length, always apply regardless of what local OU administrators configure downstream.

When multiple GPOs configure the same setting for the same object, Group Policy resolves the conflict using a fixed precedence: Enforced links win first, evaluated from highest in the hierarchy to lowest if multiple enforced GPOs conflict; then, among non-enforced links, the GPO closest to the object (OU over domain over site) wins; and within the same link level, GPOs are applied in the link order shown in GPMC, with the lowest link order number processed last and therefore winning. Loopback processing adds a further wrinkle: when enabled on a GPO linked to a computer's OU (commonly for kiosks or RDS session hosts), it replaces or merges the user's own User Configuration with the User Configuration of GPOs linked to the computer's OU, so the computer's location — not the user's normal OU — governs the user experience.