MLGPOs and Group Policy Processing

In earlier versions of Windows, Group Policy processing is applied in the following order:

1. Local Computer Policy
2. Site GPOs
3. Domain GPOs
4. Organizational unit GPOs

Policy is applied so that the policy setting closest to the user or computer takes precedence unless the ordering is changed using GPMC capabilities (overriding, blocking from above, disabling GPO or computer/user portions of the GPO). For example, if a certain policy is configured as Enabled at the domain level but Disabled at the OU level and if the computer and/or user objects are also contained at this OU level, the last value (Disabled) wins and is the effective value for the policy.

Windows 7 uses the same Group Policy processing order, as well as the "last writer wins" method. However, because Windows 7 includes three levels of local policy, processing this policy requires additional steps:

1. Local Computer Policy
2. Administrators and Non-Administrators Local Group Policy (user-based policy only)
3. User-Specific Local Group Policy (user-based policy only)

For information on how to configure MLGPOs, see the section titled "Understanding Multiple Local Group Policy" earlier in this tutorial. For information on how to disable the processing of Multiple Local Group Policy in a domain environment, see the section titled "Configuring Group Policy Processing" later in this tutorial.