1
00:00:03,780 --> 00:00:08,340
Group policies can be created at multiple levels on a replied in the following order.

2
00:00:08,370 --> 00:00:12,330
Local computer site domain and then organizational unit.

3
00:00:12,360 --> 00:00:16,650
This is one of the most important things to remember about group policy management as it's something

4
00:00:16,650 --> 00:00:20,100
you'll need to know when managing GPO on a day to day basis.

5
00:00:20,100 --> 00:00:23,400
This means that by default EU policy takes precedence.

6
00:00:23,400 --> 00:00:28,710
However the settings that apply are a combination of all levels put together on y settings are applied

7
00:00:28,770 --> 00:00:29,970
that say otherwise.

8
00:00:29,970 --> 00:00:35,470
For example if you have a desktop wallpaper policy applied at the local level desktop wallpaper applied

9
00:00:35,470 --> 00:00:38,910
at the Domain level a map network drives configured at the EU level.

10
00:00:38,970 --> 00:00:42,420
The user would receive both the domain desktop wallpaper and the map.

11
00:00:42,420 --> 00:00:48,000
Network drives because the domain wallpaper policy would override the local wallpaper policy.

12
00:00:48,120 --> 00:00:53,520
In practice local policies are rarely used as it would need to happen to set them manually on all machines.

13
00:00:53,520 --> 00:00:56,270
This is especially true in the case of large companies.

14
00:00:56,340 --> 00:01:01,740
Also there will be security implications in some cases of having local policies on every machine.

15
00:01:01,740 --> 00:01:06,810
A good example being of a local administrator account password was set this way and needed to be changed

16
00:01:06,810 --> 00:01:09,950
quickly on a large number of computers at the same time.

17
00:01:09,990 --> 00:01:13,740
However there are two settings that can change that group policy precedence order.

18
00:01:13,770 --> 00:01:19,770
These are block policy inheritance found no use unenforced found on group policies themselves block

19
00:01:19,770 --> 00:01:25,680
policy and herons can be used to prevent policy settings from GPO on the levels of both from being applied.

20
00:01:25,680 --> 00:01:30,410
For example if you have a department that needs a different desktop wallpaper so the rest of the company.

21
00:01:30,420 --> 00:01:34,710
This will block that setting but it would mean that any other settings that you want to apply would

22
00:01:34,710 --> 00:01:39,830
need to be set manually enforced is used if you want to stop the use of block policy in.

23
00:01:39,840 --> 00:01:44,850
For example if your company has a heads office and multiple satellite offices the head office may wish

24
00:01:44,850 --> 00:01:47,310
to stop anyone from changing certain settings.

25
00:01:47,340 --> 00:01:52,740
For example if they want to control desktop wallpaper essentially if enforced was applied it would mean

26
00:01:52,740 --> 00:01:57,990
that using block policy inheritance a satellite office would have no effect to set either the block

27
00:01:57,990 --> 00:02:03,870
policy inheritance or enforced options simply right click on the GPO or oyu and click on the option

28
00:02:03,870 --> 00:02:05,270
that you wish to use.

29
00:02:05,310 --> 00:02:09,390
Now that we've gone over group policy precedence let's move on to password policies.