1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Question about GPOs

Discussion in 'Windows Vista / 7 / 8 Client Exams' started by Methodman85, May 18, 2008.

  1. Methodman85

    Methodman85 Byte Poster

    244
    6
    32
    There's a review question in a book I am reading. The answer doesn't make sense to me and I'm wondering if it's a misprint. Can I post the question and answer here? Is that allowed?
     
    Certifications: MCTS, MCSE, MCSA:M, CCNA, MCDST, N+
    WIP: 70-680
  2. Methodman85

    Methodman85 Byte Poster

    244
    6
    32
    Well I won't post the question and answer, But I'll just ask my own based on it.

    If you have a group of systems in an OU, you configure local policies on each of the systems, and all the the GPOs are configured with the No Override option, which policies would take over if there was a conflict?

    The no override option prevents lower level GPs from overriding higher level GPs correct?
    So if this was the case wouldn't the OU policy win out?

    It goes Local, site, domain, and OU correct?
     
    Certifications: MCTS, MCSE, MCSA:M, CCNA, MCDST, N+
    WIP: 70-680
  3. Bluerinse
    Honorary Member

    Bluerinse Exabyte Poster

    8,871
    167
    256
    Firstly, it's not permitted to post actual content from study guides due to copyright limitations, so thanks for taking the time to formulate your own question.

    Yes the OU policy is senior in the hierachy and processed after the local policies and therefore the local policies will inherit the settings. I don't believe you can set a local policy as no overide, because there isn't anything 'lower' in the hierachry (chain) to inherit the settings.

    yes L-S-D-OU OU OU
     
    Certifications: C&G Electronics - MCSA (W2K) MCSE (W2K)
  4. Methodman85

    Methodman85 Byte Poster

    244
    6
    32
    Thanks Blurinse
    So if you had a marketing OU within a domain test.com. And you placed that domain within a site called corporate. Then the site would be the top level?
     
    Certifications: MCTS, MCSE, MCSA:M, CCNA, MCDST, N+
    WIP: 70-680
  5. Bluerinse
    Honorary Member

    Bluerinse Exabyte Poster

    8,871
    167
    256
    I think you are confusing the terms site and domain.

    A site, once defined in AD Sites and services, is a collection of computers and servers (domain controllers etc) and other devices connected by a fast network, typically a building with a local area network (LAN).

    A domain is a security boundary, all account policies are set at the domain level. The domain is the top of the tree.

    A domain can be split across many different sites, such as London, Birmingham, Leeds for example.
     
    Certifications: C&G Electronics - MCSA (W2K) MCSE (W2K)
  6. Methodman85

    Methodman85 Byte Poster

    244
    6
    32
    Hrm, This book says a site is a collection of domains. It didn't make sense to me either. The question is what's confusing me... I think, or maybe I just don't know lol.
    Alright let me ask another question.
    Alright You have an AD structure that consists of a domain test.com, which is part of a site called corporate.
    Within it there's an OU, lets call it marketing, each computer withing marketing has a local policy. All gpos were configured with no override. Based on this which policy would win?

    Does the question I just asked even make sense? Because as you said a site is a collection of servers etc within a domain correct?

    So what would happen to the domain GP if you applied a GP to a site that contained All of your domain controllers?
     
    Certifications: MCTS, MCSE, MCSA:M, CCNA, MCDST, N+
    WIP: 70-680
  7. Sparky
    Highly Decorated Member Award

    Sparky Zettabyte Poster Moderator

    10,191
    299
    319
    A site in AD sites and services is an actual physical site, you can control replication etc. between sites and also create a GPO for that site. You may have two domains in a site therefore both domains would use the site level GPO you have configured.

    In another case you could have one domain spread over 3 sites. Therefore a site level GPO would just apply to the users\computers in that physical location (a typical example is to configure a proxy server as that can be site specific) however if you created a domain level GPO that would apply to all 3 sites as the domain is replicated to all three sites. 8)
     
    Certifications: MSc MCSE MCSA:M MCSA:S MCITP:EA MCTS(x5) Security+ Network+ A+
    WIP: Exchange 2007\2010
  8. Bluerinse
    Honorary Member

    Bluerinse Exabyte Poster

    8,871
    167
    256
    Damn it's hard to explain in a couple of paragraphs, which probably explains why people write *books* on this stuff :biggrin
     
    Certifications: C&G Electronics - MCSA (W2K) MCSE (W2K)
  9. ffreeloader

    ffreeloader Terabyte Poster

    3,661
    106
    167
    One of the books that helped me to understand GPOs when I studying MS stuff was the one below. I had an early edition of this book that only covered Win2K, but if this release is anywhere nearly as good as the first one was I'd highly recommend this for anyone struggling with GPOs. It was far and away the best resource I found for understanding them.

    http://www.amazon.com/Profiles-Inte...4470/ref=pd_sim_b_title_3/102-0406682-2069708
     
    Certifications: MCSE, MCDBA, CCNA, A+
    WIP: LPIC 1
  10. onoski

    onoski Terabyte Poster

    3,120
    51
    154
    You can also find the book "windows server 2003 pocket administrator" very helpful in this regards. It would give you a concise picture and definition of GPO's, sites, domain and domain controllers etc. Cheerio and best wishes:)
     
    Certifications: MCSE: 2003, MCSA: 2003 Messaging, MCP, HNC BIT, ITIL Fdn V3, SDI Fdn, VCP 4 & VCP 5
    WIP: MCTS:70-236, PowerShell
  11. Methodman85

    Methodman85 Byte Poster

    244
    6
    32
    Thanks everyone, well my 270 is on tuesday so no time to order another book. But I think I understand now.
    It all depends on the situation.
    I'll have to be extra careful on the scenario for the GPO questions.
    So if the question states that you have a domain, and that domain is completely contained within a site, the GPO configured at that site would be in control based on the question's scenario.
     
    Certifications: MCTS, MCSE, MCSA:M, CCNA, MCDST, N+
    WIP: 70-680

Share This Page

Loading...