Re: No Override option

From: Chriss3 (noSpamHere_at_chrisse.se)
Date: 02/02/04 

Date: Mon, 2 Feb 2004 17:06:38 +0100

You can set No Override on a specific Group Policy object link so that Group
Policy objects linked at a lower-level of Active Directory - closer to the
recipient user or computer account - cannot override that policy. If you do
this, Group Policy objects linked at the same level, but not as No Override,
are also prevented from overriding. If you have several links set to No
Override, at the same level of Active Directory, then you need to prioritize
them. Links higher in the list have priority on all Configured (that is,
Enabled or Disabled) settings.

If you have linked a specific Group Policy object to a domain, and set the
Group Policy object link to No Override, then the configured Group Policy
settings that the Group Policy object contains apply to all organizational
units under that domain. Group Policy objects linked to organizational units
cannot override that domain-linked Group Policy object.

You can also block inheritance of Group Policy from above in Active
Directory. This is done by checking Block Policy inheritance on the Group
Policy tab of the Properties *** of the domain or organizational unit.
This option does not exist for a site.

Some important facts about No Override and Block Policy are listed below:

  a.. No Override is set on a link, not on a site, domain, organizational
unit, or Group Policy object.
  b.. Block Policy Inheritance is set on a domain or organizational unit,
and therefore applies to all Group Policy objects linked at that level or
higher in Active Directory which can be overridden.
  c.. No Override takes precedence over Block Policy Inheritance if the two
are in conflict.
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/prodtechnol/windows2000serv/reskit/distsys/part4/dsgch22.asp 

-- 
Regards,
Christoffer Andersson
No email replies please - reply in the newsgroup
If the information was help full, you can let me know at:
http://www.itsystem.se/employers.asp?ID=1
"Kyle" <anonymous@discussions.microsoft.com> skrev i meddelandet
news:836c01c3e9a5$59a3d290$a301280a@phx.gbl...
> Can someone explain to me the purpose of the "No
> Override" option in a GPO.  Is the "No Override" applied
> only to the settings within the GPO, or all setttings?
>
> For example, suppose I have a GPO at the OU level that
> specifies the user is not allowed to right click and
> another GPO at the domain level that only specifies the
> home page of IE.  Now, if I apply the "No Override"
> option to the domain level GPO, will the user be able to
> right click or is this overwritten b/c of the "No
> Override" option?
>
> Thank you for you time.