in a GPO, which takes precedence, user or computer configuration?

By Nonapeptide ·
If a setting in the Computer Configuration portion of a GPO conflicts with the setting in the User Configuration portion, which one wins?

Google failed me.

This conversation is currently closed to new comments.

11 total posts (Page 1 of 2)   01 | 02   Next
| Thread display: Collapse - | Expand +

All Answers

Collapse -

well in GPOs neither take precedence

by CG IT In reply to in a GPO, which takes pre ...

because it's not computer or user config that determines policy settings rather the processing order and parent child OUs.

For instance, if a parent had GP and child doesn't parent applies to child.

If parent and child both have them and there are no conflicts, child applies. later GPOs apply than earlier ones

If parent and child both have them and there is a conflict child applies. [later GPO applied].

GPO policy settings are also cumulative [if there are no conflicts].

Collapse -

True enough, but...

by Nonapeptide In reply to well in GPOs neither tak ...

...I was thinking of the (hopefully) unlikely case where an option in "User Configuration" and its counterpart in "Computer Configuration" were set to conflicting choices in the same GPO.

More of a theoretical question I suppose. It was just something that popped into my (weird) head as I studied up on Active Directory.

Collapse -

I thought of that as well...

by CG IT In reply to True enough, but...

and wanted to go through all the different available settings in both just to see if there might be duplicate settings.

But within the first couple of minutes of comparing, I went blurry eyed.

I didn't find any MS document that addresses this possibility.

Collapse -


by Nonapeptide In reply to I thought of that as well ...

I thought about setting up this scenario in my lab, but didn't think it was worth the time. I posted the question in hopes of finding someone who had experience with this situation.

Of course, if someone actually set conflicting GPO settings in the same GPO, they might better get more sleep or consider a new line of work.

Thanks for rubbing some brain cells together over it though.

Collapse -

no problem Non

by CG IT In reply to Ditto

it's something I've always wondered about and believe it or not it's on the to do list [carry over from previous years] but way down at the bottom.

I'm not sure MS actually has duplicate settings for computer and users. Be sorta like building in a huge problem.

There is one place to ask and that's on MS Technet Community Forums. MS tech people regularly post there.

Collapse -

Here's a candidate:

by Nonapeptide In reply to no problem Non

I just poked through my GP settings on my Vista machine and found some dupes. Try these on for size (not sure if they exist in XP. I'm assuming they do): [Computer Configuration | User Configuration] >> Administrative Templates >> Network >> Offline Files

There's a few duplicates in there.

Oooh ooh! Found a few more in [Computer Configuration | User Configuration] >> Administrative Templates >> System

There's probably loads of 'em here and there.

Collapse -

well ok I'll try em out on the test network

by CG IT In reply to Here's a candidate:

which runs W2003 Server AD with XP client. Gimme some examples you want to know about and I'll give it a whirl later on tonight.

Least it will get that pesky to do item off the list once and for all [think it's been on there for at least 4 years ROFL]

Do a RSOP and see what happens and let you know.

Collapse -

Saves me the arduous task of...

by Nonapeptide In reply to Here's a candidate:

remoting into the server in my closet and twiddling with AD. It's so taxing to do these things for one's self, you know.

The effort I've put into posting about it here could have answered the original question and then some. :) Of course, since you've offered, I won't refuse. How about:

[computer configuration | user configuration] >> Administrative templates >> windows components >> Windows Messenger >> Do not allow windows messenger to be run

Enable one and disable the other and we'll see what happens. Something about an unstoppable force meeting an immovable object comes to mind.

Get the fire extinguisher ready.

Collapse -


by Nonapeptide In reply to in a GPO, which takes pre ...

Thanks to the Elder Geek! Computer Configuration always wins out.

Still can't give myself a thumb...

Collapse -

Hey! well thats a great article.

by CG IT In reply to Solved!

printed that sucker out for the reference file.

I'll do a question and give you a thumb....

Back to Desktop Forum
11 total posts (Page 1 of 2)   01 | 02   Next

Related Discussions

Related Forums