Share this article
Improve this guide
How to Block GPO Inheritance [Quick Guide]
Needing to block inheritance is important, and here’s how you do it
3 min. read
Updated onOctober 4, 2023
updated onOctober 4, 2023
Share this article
Improve this guide
Read our disclosure page to find out how can you help Windows Report sustain the editorial teamRead more
Key notes
Administrators can apply hundreds of different settings to objects in AD by establishing Group Policy Objects (GPOs) and associating the GPO to domains, sites, and organizational units (OUs).
You might be wondering how to block inheritance for such groups, so we will show you. We can also show youhow to block inheritance for Windows 10if interested.
What is GPO inheritance, and how does it work?
Well, as you might know, in Active Directory, GPOs are inherited automatically throughout the GPO application order.
So, if a Group Policy setting is enabled at the highest domain level but is not configured at the OU level, the highest domain level setting takes precedence and is applied.
That being said, equally, if a setting is not configured at the domain level and is disabled at the OU level, the OU setting is inherited.
But there’s also the situation whenGroup Policy is not applying, but this guide will help fix it.
If you were wondering about the order in which the Group Policy settings take effect, allow us to shed some light on that as well:
You may also be interested inhow to install Group Policy Management Console on Windows 11.
How do I block Group Policy inheritance for a Domain/OU?
- Press theWindowskey to open the search box. Alternatively, you can press theStartbutton on the taskbar.
2.Search forgroup policy, and select the first result to open theEdit Group Policyapp.
-
Go toGroup Policy Managementand locate the group policy, then accessDomainsand select your domain, and finally go toDefault Domain Policy.
-
UnderDomain Controllers, locatethe domain you wish to stop inheriting settings.
-
Right-click on it andselectBlock Policy inheritance.
You can easily block the Group Policy inheritance for a specific Domain/OU via the Group Policy Editor. All you need to do is locate your domain in the list and apply theBlock Inheritancesetting to it.
If you have any trouble, you may also use our guide onhow to fix Group Policy in Windows.
Can I disable a GPO entirely?
You should know that, by default, both the Computer Configuration and User Configuration policy settings of a GPO are enabled and applied to all users and computers in the container in which the GPO is linked.
That being said, situations may arise where the GPO has to be disabled for a particular period. So, the answer is yes, you absolutely can.
In case you’re wonderingHow do I disable a GPO?, take a closer look at our detailed procedure.
You can also modify such settings using PowerShell, if that is the software you are more comfortable with, just so you know.
If you’re interested, you may evenadd a VPN by using the Group Policy in Windows, so take a look at this guide.
This is all you need to know about this subject. We hope this article helped you solve whatever problems you are having. Leave a comment below and tell us how you feel about it.
Alexandru Poloboc
Tech Journalist
With an overpowering desire to always get to the bottom of things and uncover the truth, Alex spent most of his time working as a news reporter, anchor, as well as TV and radio entertainment show host.
A certified gadget freak, he always feels the need to surround himself with next-generation electronics.
When he is not working, he splits his free time between making music, gaming, playing football, basketball and taking his dogs on adventures.
User forum
0 messages
Sort by:LatestOldestMost Votes
Comment*
Name*
Email*
Commenting as.Not you?
Save information for future comments
Comment
Δ
Alexandru Poloboc
Tech Journalist
With a desire to always get to the bottom of things and uncover the truth, Alex spent most of his time working as a news reporter.
