Trong hình 6-11, Khu thừa kế chính sách đã được áp dụng cho OU khách hàng. Kết quả là, 1 GPO, được áp dụng cho trang web bị chặn và không áp dụng cho OU khách hàng. Tuy nhiên, 2 GPO, liên quan đến lĩnh vực với các tùy chọn Enforced, không áp dụng. | Lesson 2 Managing Group Policy Scope 261 In Figure 6-11 Block Policy Inheritance has been applied to the Clients OU. As a result GPO 1 which is applied to the site is blocked and does not apply to the Clients OU. However GPO 2 linked to the domain with the Enforced option does apply. In fact it is applied last in the processing order meaning that its settings will override those of GPOs 6 and 7. GPO processing order for the Contractors OU 1 3 4 5 2 GPO processing order for the Laptops OU 6 7 2 Figure 6-11 Policy processing with Block Inheritance and Enforced options When you configure a GPO that defines configuration mandated by your corporate IT security and usage policies you want to ensure that those settings are not overridden by other GPOs. You can do this by enforcing the link of the GPO. Figure 6-12 shows just this scenario. Configuration mandated by corporate policies is deployed in the CONTOSO Corporate IT Security Usage GPO which is linked with an enforced link to the domain. The icon for the GPO link has a padlock on it the visual indicator of an enforced link. On the People OU the Group Policy Inheritance tab shows that the GPO takes precedence even over the GPOs linked to the People OU itself. To facilitate evaluation of GPO precedence you can simply select an OU or domain and click the Group Policy Inheritance tab. This tab will display the resulting precedence of GPOs accounting for GPO link link order inheritance blocking and link enforcement. This tab does not account for policies that are linked to a site nor does it account for GPO security or WMI filtering. 262 Chapter 6 Group Policy Infrastructure - Group Policy Management B J Forest Power User Configuration ligf Standard User Configuration - Ễ g J CONTOSO Corporate IT Security Usi g CONTOSO Standards Default Domain Policy IB gT Admins IB ai Domain Controllers j i People People Linked Gloup Policy Objects Group Policy Inheritance 1 Delegation j This list does
