Some things you can do, again, this isn't really proven practice nowadays,
but it's something you can do with Group Policy,
and it might show up on the exam,
which is why I'm showing it, is you can, for example,
block inheritance.
So you see here,
I'm configuring Block Inheritance in my HQ Data Team
organizational unit in my timw.info domain.
And the idea here is that if there's a Group Policy scoped higher than the
OU, for instance, the domain or site levels, then the block inheritance
would prevent those upper GPOs from applying.
Is that a good idea?
Well, this is really an edge case.
I just want you to be aware that it's possible to configure
that. Now, you might think, yikes, well,
what if you have domain policy that's governing passwords and your
compliance requires that all organizational units consume those
settings? You can enforce a Group Policy link.
And when you enforce a link, like you see here,
I'm enforcing my Default Domain Policy,
that's going to ensure that those settings take precedence
and they break through block inheritance.
And when I say take precedence,
they will also, that is, the enforced settings, will always override any
other conflicts in that LSDOU hierarchy I mentioned before.
So for your highest priority settings, you might want to consider
enforced, but the reason why blocking and enforcement aren't really
recommended so much, at least I don't formally recommend them unless you
know you need them, is because it's going to ramp up your troubleshooting
when it comes time to resolving resultant set of policy issues with your
users and computers.
What about Group Policy refresh?
Hopefully you would expect that Group Policy is on a refresh cycle such that
if you as an administrator make a change to Group Policy,
you'd like that to be, in effect, in your management scopes as soon as possible.
Well, for domain controllers,
they refresh their own policy every 5 minutes by default.
All domain members,
it's a 90‑minute refresh cycle with a randomized 30‑minute offset.
Why the offset?
Well,
it's so you don't get a whole bunch of Group Policy refresh requests at once,
so you don't swarm or flood your domain controllers,
particularly your PDC Emulator FSMO role holder.
Now, GPOs are replicated across all domain controllers using that
SYSVOL special shared directory, and again,
it's the PDC Emulator that's responsible for managing Group
Policy, so your Group Policy is going to fall flat on its face
if your PDC Emulator is offline.
This ties into our earlier learning where I taught you how to manage FSMO
roles and potentially seize a role if you're in an emergency. You can force a
Group Policy refresh on a local and/or N number of remote machines by using the PowerShell cmdlet Invoke‑GPUdate.