Lesson 3

Deploying Role-Specific GPOs

9-35

Tip

If you plan to create a hierarchy of organizational units that includes domain controllers

in one of the role-specific containers, you will not be able to move the Domain Controllers

organizational unit object that Windows Server 2003 creates automatically at domain cre-

ation to another location in the tree. However, you can create a new organizational unit object

in the hierarchy and move the computer objects there from the Domain Controllers container.

To create security configurations for the servers in the role-specific organizational units,

you create a new GPO for each container. When you do this, the policy settings in the

GPOs linked to the role-specific containers take precedence over the settings for the

same policies in the parent container’s GPO. The rules governing the combination of

inherited and direct policy settings are as follows:

■

If the parent container’s GPO contains a policy setting, and the same policy is

undefined in the child container’s GPO, the objects in the child container use the

setting from the parent GPO.

■

If the child container’s GPO contains a policy setting, and the same policy is unde-

fined in the parent container’s GPO, the objects in the child container use the set-

ting from the child GPO.

■

If the parent container’s GPO contains a policy setting, and the same policy has a

different setting in the child container’s GPO, the objects in the child container use

the setting from the child GPO.

Real World GPO Combination

When you apply multiple GPOs to a container, whether with multiple links or

with a hierarchical GPO arrangement, it is important to understand the differ-

ence between an undefined policy and an explicit policy setting. An undefined

policy is not necessarily the same as a Disabled setting. When you leave a pol-

icy undefined in the GPO, the computers to which that GPO applies use the

operating system’s default setting, which might be Enabled, Disabled, or some-

thing else, depending on the policy. If you define a policy with an Enabled

value in the parent container’s GPO, you must explicitly define the same policy

in the child container’s GPO to assign it a different value, even if that value is

the same as the Windows Server 2003 default setting.

Practice: Deploying Multiple GPOs

In this practice, you use two different methods to combine the policies in the GPOs

you created for the Member Servers and Domain Controllers organizational units in

the practices for Lessons 1 and 2 of this chapter. First, you link both GPOs to a sin-

gle container and modify the order in which the system applies them. Then, you