Controlling Which Objects a GPO Affects
Linking a GPO to a container determines the broad population of computers and users it can reach, but three additional mechanisms narrow that scope further: security filtering, WMI filtering, and item-level targeting inside Group Policy Preferences. Security filtering restricts a linked GPO so it only applies to security principals (users, computers, or groups) that have both Read and Apply Group Policy permissions on the GPO; by default, Authenticated Users has both, so removing that entry and adding a specific security group is the standard way to target a subset of an OU. WMI filtering goes further by evaluating a WQL query against each machine at processing time, applying the GPO only if the query returns true, which is useful for targeting by OS version, disk space, or hardware attributes rather than group membership.
Cricket analogy: Security filtering is like a franchise announcing a training camp open to the whole squad but only issuing kit to players on the actual playing XI list, while WMI filtering is like admitting only players who meet a specific fitness test score on the day.
Block Inheritance and Enforced Links
By default, GPOs linked higher in the hierarchy flow down to child OUs, but Block Inheritance can be set on an OU to stop GPOs linked above it (at the domain or a parent OU) from applying to objects inside it. Block Inheritance is an all-or-nothing switch on the OU itself, not on individual GPOs. The Enforced flag, set on a specific GPO link, overrides Block Inheritance for that one link and also wins any conflict against a closer, non-enforced GPO, meaning an enforced domain-level policy will apply even to an OU that has Block Inheritance turned on. This combination lets security teams guarantee that critical baseline settings, like a minimum password length, always apply regardless of what local OU administrators configure downstream.
Cricket analogy: Block Inheritance is like a franchise's youth academy declaring it won't follow the senior team's training regimen, while an Enforced link is like the board mandating a specific injury-prevention protocol that even the rebellious academy must follow.
Conflict Resolution Precedence
When multiple GPOs configure the same setting for the same object, Group Policy resolves the conflict using a fixed precedence: Enforced links win first, evaluated from highest in the hierarchy to lowest if multiple enforced GPOs conflict; then, among non-enforced links, the GPO closest to the object (OU over domain over site) wins; and within the same link level, GPOs are applied in the link order shown in GPMC, with the lowest link order number processed last and therefore winning. Loopback processing adds a further wrinkle: when enabled on a GPO linked to a computer's OU (commonly for kiosks or RDS session hosts), it replaces or merges the user's own User Configuration with the User Configuration of GPOs linked to the computer's OU, so the computer's location — not the user's normal OU — governs the user experience.
Cricket analogy: Conflict resolution is like a match referee's decision overriding the on-field umpire's call only when a formal review is enforced, while among ordinary umpiring decisions the nearer official's call (square leg vs. third umpire) generally stands.
# Deny Apply Group Policy for a group (security filtering)
$gpo = Get-GPO -Name "Finance-Desktop-Restrictions"
Set-GPPermission -Guid $gpo.Id -TargetName "Contractors" -TargetType Group -PermissionLevel GpoApply -Deny
# Enforce a GPO link so it overrides Block Inheritance and closer GPOs
Set-GPLink -Name "Security-Baseline" -Target "DC=contoso,DC=com" -Enforced Yes
# Block inheritance on a specific OU
Set-GPInheritance -Target "OU=R&D,DC=contoso,DC=com" -IsBlocked Yes
# Attach a WMI filter restricting a GPO to Windows Server 2022 machines
$filter = Get-WmiFilter -Name "WinServer2022Only"
Set-GPO -Name "Server-Hardening" -WmiFilter $filterOverusing Block Inheritance and Enforced links across many OUs makes troubleshooting extremely difficult because effective policy can no longer be predicted just by reading the OU tree top to bottom. Keep the number of enforced GPOs small and reserve Block Inheritance for genuinely isolated OUs, such as a lab environment that must remain unaffected by the production security baseline.
WMI filters are evaluated on every applicable computer at every background refresh, and a poorly written WQL query (for example, querying Win32_Product, which triggers an MSI consistency check) can noticeably slow down Group Policy processing across the whole targeted OU. Prefer lightweight queries against Win32_OperatingSystem or Win32_ComputerSystem instead.
- Security filtering narrows a linked GPO to specific users, computers, or groups via Read + Apply Group Policy permissions.
- WMI filtering applies a GPO conditionally based on a WQL query evaluated on each target machine.
- Block Inheritance stops GPOs linked above an OU from flowing down, and is set on the OU, not the GPO.
- Enforced links override Block Inheritance and always win precedence conflicts against non-enforced, closer GPOs.
- Within the same link level, GPMC link order determines precedence, with the lowest order number applied last and winning.
- Loopback processing lets a computer's OU location govern User Configuration instead of the user's own OU, useful for kiosks and RDS hosts.
- Avoid overusing Block Inheritance and Enforced links, since they make effective policy harder to predict.
Practice what you learned
1. What is the default security group that must be removed to restrict a GPO to only a subset of users via security filtering?
2. What does setting Block Inheritance on an OU do?
3. What effect does marking a GPO link as Enforced have?
4. What is Group Policy loopback processing primarily used for?
5. Why should WMI filters avoid querying Win32_Product?
Was this page helpful?
You May Also Like
Group Policy Objects Explained
An introduction to Group Policy Objects (GPOs), how they store settings, and how they get applied to users and computers in Active Directory.
Common GPO Settings
A tour of the most frequently configured Group Policy settings for security baselines, password policy, software restriction, and administrative templates.
GPO Troubleshooting with gpresult and RSoP
How to diagnose Group Policy application problems using gpresult, the Resultant Set of Policy snap-in, gpupdate, and Group Policy event logs.
Related Reading
Related Study Notes in Microsoft Technologies
Browse all study notesWindows 10 / UWP Development Study Notes
.NET · 30 topics
Microsoft TechnologiesWindows Batch Scripting Study Notes
Batch · 30 topics
Microsoft TechnologiesMFC (Microsoft Foundation Classes) Study Notes
C++ · 30 topics
Microsoft TechnologiesSilverlight Study Notes
.NET · 30 topics
Microsoft TechnologiesXAML Study Notes
.NET · 30 topics
Microsoft TechnologiesWPF (Windows Presentation Foundation) Study Notes
.NET · 30 topics