Intermediate 4 min read Updated: Sep 09, 2026

Group Policy Processing Order: Local, Site, Domain & OU (LSDOU)

Master enterprise Active Directory Group Policy precedence: the LSDOU processing model, Block Inheritance, Enforced overrides, Security Filtering, and gpresult troubleshooting.

In an enterprise Active Directory environment, Group Policy is the primary configuration management engine used by systems administrators to centrally enforce security baselines, deploy software, configure registry keys, map network shares, and restrict user privileges across thousands of Windows endpoints. However, when multiple Group Policy Objects (GPOs) apply to the same computer or user account, determining which policy setting wins requires an exact understanding of Group Policy precedence rules.

The universal precedence framework that governs all Group Policy evaluation is known as LSDOU (Local, Site, Domain, Organizational Unit).

The LSDOU Precedence Hierarchy

Group Policy applies cumulatively in a strict sequential order. The setting that is processed last overwrites any conflicting settings applied earlier in the processing sequence.

Processing Order Policy Scope Storage Location & Precedence Level
1. First (Lowest Precedence) Local Group Policy Stored locally on the endpoint in C:\Windows\System32\GroupPolicy. Evaluated first. Any domain-level policy setting will completely overwrite conflicting local settings.
2. Second Site-Level GPOs Linked to the Active Directory Site object in Active Directory Sites and Services. Affects all computers and users situated within the physical subnet boundary of that AD site.
3. Third Domain-Level GPOs Linked at the root of the Active Directory domain (e.g. Default Domain Policy). Applies globally to all user and computer accounts within the domain boundaries.
4. Fourth (Highest Precedence) Organizational Unit (OU) GPOs Linked to specific OUs. If OUs are nested, child OUs are evaluated after parent OUs, meaning settings linked to the deepest child OU overwrite conflicting settings from parent OUs.
The "Last Writer Wins" Rule
Because policies apply sequentially from Local → Site → Domain → Parent OU → Child OU, the Child OU GPO possesses the highest precedence and wins all conflicts by default.

Multiple GPOs at the Same Level: Link Order

When multiple GPOs are linked to the exact same container (such as the same OU), conflict resolution is determined by the Link Order integer:

  • Link Order starts at 1 and counts upwards (1, 2, 3, etc.).
  • GPOs are processed in reverse link order: Link Order 3 processes first, followed by Link Order 2, and finally Link Order 1.
  • Therefore, Link Order 1 has the highest priority and overwrites any conflicting settings from higher link order numbers on the same container.

Overriding Precedence: Block Inheritance vs Enforced

Administrators can alter default LSDOU processing behavior using two powerful mechanisms:

1. Block Inheritance

Applied to an entire Organizational Unit container. When an administrator selects "Block Inheritance" on an OU, all incoming policy settings from parent OUs, the Domain level, and the Site level are stopped at the container boundary. Only GPOs linked directly to that specific OU (or child OUs beneath it) are processed.

2. Enforced (Formerly "No Override")

Applied to an individual GPO link (typically at the Domain or Site level). When a GPO link is marked Enforced:

  • Its settings cannot be blocked by downstream "Block Inheritance" flags on child OUs.
  • Its settings take ultimate precedence over all conflicting policies, even those applied at child OUs.
  • If multiple Enforced GPOs conflict, the Enforced GPO at the highest container level (Site before Domain, Domain before OU) wins.
Enterprise Anti-Pattern: Overusing Enforced
Marking GPOs as "Enforced" breaks natural OU hierarchy and makes troubleshooting policy conflicts extremely difficult. Enterprise architects restrict Enforced status strictly to non-negotiable global baselines (such as the Default Domain Password Policy or critical security auditing).

Targeting Controls: Security Filtering & WMI Filters

GPOs do not have to apply uniformly to every object in an OU:

  1. Security Filtering: By default, every GPO grants "Read" and "Apply Group Policy" permissions to Authenticated Users. By removing Authenticated Users and adding a specific Security Group (e.g. SEC-Finance-Workstations), the GPO will only evaluate on machines that are members of that group.
  2. WMI Filtering: Evaluates a WQL query on the client machine before applying settings. For example, a GPO can be restricted to execute only if the client machine is running Windows Server 2025 or is a battery-powered mobile laptop: SELECT * FROM Win32_OperatingSystem WHERE Version LIKE '10.0.26%' AND ProductType = '3'.

Troubleshooting Policy Processing with gpresult

When settings fail to apply, systems administrators use gpresult to generate an exact diagnostic report showing applied GPOs, denied GPOs, and winning settings:

Command Prompt / PowerShell (Run as Administrator) 
# Force immediate re-evaluation of Group Policy without waiting for the 90-minute refresh interval
gpupdate /force

# Generate a detailed HTML diagnostic report of applied policies
gpresult /h "C:\Temp\GPO_Report.html"

Summary

Group Policy is the backbone of Windows enterprise configuration. By mastering the Local → Site → Domain → OU processing sequence, respecting Link Order precedence, utilizing Block Inheritance and Enforced flags prudently, and inspecting runtime execution with gpresult, systems engineers maintain predictable, compliant, and rock-solid directory infrastructure.

Code copied to clipboard!