Hello, Cloud Gurus, and welcome back.
In this lesson, we're going to take a look
at Group Policy inheritance.
Let's take a look at what we're going to cover.
First up, we'll take a look
at how Group Policy is refreshed both in the background
and how you can manually refresh Group Policy.
Then we'll take a look
at where you can link your Group Policy Objects to.
We'll take a look at the Group Policy processing order,
and then we'll take a look at the differences
between block inheritance and enforced.
And then we'll wrap up with a bit of a demo
of Group Policy inheritance.
Let's jump in.
So we've talked quite a lot
about configuring Group Policy settings, but when exactly
do Group Policy clients apply these settings?
Well, first, it's important to know
that Group Policy clients
will apply the settings automatically.
And this is done at 3 regular intervals.
The first is at startup
where the computer configuration is applied.
And then Group Policy is applied again
at log on using the user configuration.
And then it's also applied in the background randomly
between every 60 and 120 minutes.
But you can also trigger a Group Policy refresh manually
by running the GPUPDATE command
on a client computer to trigger a Group Policy update.
And you can target either the user policies,
the computer policies, or both.
You can also trigger a Group Policy update centrally
for groups
of computers using the Group Policy Management Console
or PowerShell using
the Invoke-GPUpdate PowerShell cmdlet.
Now, remote GPUpdate uses scheduled tasks
to trigger the GPUpdate command remotely.
And it requires defender firewall ports to be open.
And Microsoft provides starter GPOs that include all
of the required firewall settings
that you need to configure.
So we already know that you can link Group Policy Objects
to organizational units to apply the settings
to the computers and/or the users
in that organizational unit.
And as you probably already noticed,
you can also link Group Policy Objects
to Active Directory domains.
The default domain policy is a great example of this,
but it's not recommended to link Group Policy Objects
at the domain level unless absolutely necessary.
And one example where you might want to do this is
where you want to override the default domain policy.
The other location that might not appear as obvious
at first is Active Directory sites.
You can link a GPO to an Active Directory site
to apply location specific settings,
such as local network shares and printers.
And at each of these link locations in Active Directory,
group policies are linked in order
and this is referred to as the link order.
Now, with all these possible locations combined
with local group policies, how does Group Policy decide
which settings take precedence when conflicts occur?
Well, that's referred to
as the Group Policy processing order.
Let's take a look at that now.
The Group Policy settings that are applicable to a computer
or user are a combination of all
of the Group Policy settings that have been applied
to that object.
And this is referred to as the resultant set
of policy or RSoP.
When a computer applies Group Policy,
it first uses the local Group Policy settings.
Then the settings configured at the site are used.
And if there is a new setting,
this setting is added to the resultant set of policy.
And if there is a conflict, the local setting is discarded
and the site setting is used.
And if there are multiple Group Policy Objects linked
to the site, the link order
for the Group Policy Objects linked to the site is used.
Group Policy links with a lower order override those
with a higher link order.
And then the domain policies are examined
in the same manner.
Those added to the resultant set
of policy earlier are retained, and domain settings
that conflict
with earlier applied settings,
override those earlier settings.
And if there are multiple Group Policy Objects linked
to the domain, the link order
for the Group Policy Objects linked to the domain is used.
And then the group policies
at the organizational unit where the computer
or user is located are added and OU settings
that conflict with earlier applied settings
override those earlier settings.
Settings and GPOs linked
to higher-level OUs are overridden
by those in lower-level OUs.
And again, link order is processed from highest to lowest.
Now, that's complex enough, right?
Well, there are a few problems with this default order.
Let's take a look.
What happens if you need to stop settings
at a higher level being applied to those
at a lower level in the directory tree?
For this, you can use block inheritance.
And block inheritance stops higher-level,
domain-based policies from being applied
to anything below the inheritance block,
including sub-domains and sub-organizational units.
Or alternatively, what if you've delegated administration
of an organizational unit to some junior administrators
and they apply settings that conflict
with settings applied higher in the hierarchy?
You might have some settings that are a corporate standard
and must be configured to meet legal obligations.
And these settings can't be overridden.
Well, in this case, you can enforce a GPO link.
Settings from an enforced GPO apply
to all objects below it in the domain tree,
even those with block inheritance configured.
Now, block inheritance
and GPO link enforcement should be used sparingly
as they'll make it complex to understand
which settings will be applied.
All right, let's take a look at a demo
of Group Policy inheritance and how block inheritance
and enforcing GPO links affects the resulting set
of applicable Group Policy.
In this demo, we have a Group Policy linked
to the domain that is applying a setting,
and we'll use block inheritance
to stop the settings configured at the domain level
from being applied at a lower level.
And once we've blocked inheritance
on the organizational unit, we'll link a new GPO
to the organizational unit and override the settings
that were being applied from the domain GPO.
And then we will use the enforced setting on the GPO link
at the domain level to force those settings
to be applied even through the block inheritance setting.
Let's take a look.
All right, here we are logged
onto the internal administrative server.
Now, let's go ahead and have a look
at the Group Policy that we've got configured here.
So I've got a Group Policy Object
called Domain Logon Message.
And then if we have a look at the settings
for this Group Policy Object,
we can see that I'm displaying a logon message
when a user connects to a computer
that this Group Policy Object is applied to.
We're going to use one of the other member servers
in our domain and test this Group Policy using that server.
So let's go ahead and update the Group Policy
for that server.
To do that, we're going to use remote Group Policy update
and we'll use the Invoke-GPUpdate PowerShell cmdlet.
We'll specify the computer that we want to update,
and then we're going to specify a random delay
in minutes to say that we want it to be updated immediately.
And then we're going to force the Group Policy update
on this computer.
Now we'll go ahead and run that to update the Group Policy
on that computer.
Now, if we flip back to the Group Policy Management Console
for a second, this is only possible
because I have some Group Policy remote
update firewall ports Group Policy Objects configured
and I've created those using the starter GPOs.
All right, with Group Policy now updated on that computer,
let's use remote desktop connection and see
if that Group Policy is applied to that computer.
So we'll go ahead and connect to that server.
And we can see that we're getting
that domain-linked GPO message that we've got applied using
that Group Policy Object.
So we'll go ahead and click OK.
And then we'll just sign out.
Now let's go ahead and block inheritance
on the server's organizational unit.
So we'll go ahead
and right-click the server's organizational unit,
and then we'll select Block Inheritance.
Now we'll go ahead and update Group Policy
on that server again.
And then let's go ahead and remote desktop to that server
and see if the Group Policy has been removed.
And we can see we're no longer getting a logon message
because we've used block inheritance to prevent
that Group Policy from being applied
to the computer in that organizational unit.
Let's go ahead and sign out.
We'll jump back to the Group Policy Management Console
and now let's override that setting
with another Group Policy Object.
I've pre-created a Group Policy Object
so we're going to link it here.
So I'll just right-click and select Link Existing GPO.
Then I'm going
to select the OU Logon Message Group Policy Object,
and then click OK.
And we'll just quickly take a look at the settings
for that OU Logon Message GPO
and we'll navigate into security settings.
And then local policies and all security options
and then down to interactive logon again.
And then we can see
that we're getting an OU-linked GPO message
that will be applied at logon.
So let's go ahead and run a GPUpdate now
that we've linked to that new Group Policy Object.
And now let's go ahead and use remote desktop
to connect to that server again.
And we can see we're getting the OU-linked GPO message.
So we'll go ahead and click OK.
And then we can sign out.
We'll just minimize PowerShell.
Now let's go ahead and enforce the Domain Logon Message
because this domain logon message could be something
that must be applied to all the computers in the domain
and we can use the enforced setting to ensure
that that is the case.
So we'll go ahead and right-click the Domain Logon Message.
And then we'll select Enforced.
And you can see here that we've got a little lock symbol
on the Group Policy Object to indicate that it's enforced.
And I've also enforced
the Group Policy Remote Update Firewall Ports
and reporting ports Group Policy Objects as well.
And that's because when we blocked inheritance here,
it actually would prevent me
from updating Group Policy remotely.
All right, so now
that we've enforced this Group Policy setting
and we also have block inheritance configured
on the servers OU, let's go ahead
and update Group Policy again.
So we'll just launch PowerShell
and then we'll invoke a GPUpdate.
And then let's go ahead and connect to the server.
And we can see here,
we're getting that enforced domain-linked GPO message.
We'll go ahead and click OK.
All right, that concludes our demo.
Let's take a look at what we're covered in this lesson.
All right, so what have we covered?
You can use the GPUPDATE command-line tool
to trigger a Group Policy refresh
and you can choose to target just the user policy,
the computer policy, or both.
And it's also important
to remember the Group Policy processing order,
which is local, site, domain,
and then organizational units.
And it's also important to remember
that Group Policy links
with a lower link order override those
with a higher link order.
And you can use block inheritance to prevent GPO settings
from higher-level GPOs applying
to users and computers below the block.
And finally, remember that settings
and enforced GPO links always take precedence
over other settings,
even where block inheritance is configured.
All right, that concludes this lesson.
Thanks for being with me
and I hope you found this useful.
And I look forward to seeing you on the next lesson.