none
Order of execution <> user configuration in AD

    Question

  • Hi everyone,

    I've read that group policies get processed in the following order:

    Local group policy -> Site -> Domain -> Organizational unit

    However we can also put some of the settings, that we can configure using group policies, in the user configuration in AD Users & Computers. Do these individual settings get priority over GPO's?

    For example: If I set a Remote desktop services user profile in my user properties to a certain path (\\fileserver\profiles). I also configure and link the following GPO setting to an OU where a computer account the user wil be logging on to resides.

    Computer Configuration > Policies > Administrative Templates > System > User Profiles (to \\applicationserver\profiles)

    I've read in a very old source that my GPO should win, but in fact I am seeing that my user configuration wins?

    You can also put settings in RDS Host configuration settings that could conflict with GPO settings, which one will get priority?

    I'm unable to find a source that confirms this? Could someone help me out with this dilemma?


    Friday, July 17, 2015 10:24 AM

All replies

  • The general rule of thumb and i think in most if not all cases is that AD user attributes beat GPO
    • Proposed as answer by AlexAdkin Monday, November 07, 2016 9:19 PM
    Friday, July 17, 2015 10:43 AM
  • Hi,

    not sure this article is the same you refer to, but it says:

    "The Group Policy setting will take precedence over the setting configured in Remote Desktop Session Host Configuration or on theRemote tab."

    So if in your environment is winning the user setting there could be some GPO issue


    This post is provided AS IS with no warranties or guarantees, and confers no rights.
    ~~~
    Questo post non fornisce garanzie e non conferisce diritti

    Friday, July 17, 2015 10:44 AM
  • Hi,

    I tested this to make sure I didn't miss anything.

    When both are applied (user config + GPO), the user config wins

    When only GPO is applied, the GPO wins and applies

    Also when I perform a gpresult /R in the case that both apply, I can see my GPO applying. There doesn't seem to be anything wrong with my GPO, because it does work.

    What I'm seeing in the link you referenced, contradicts this?? Strange...

    Friday, July 17, 2015 11:46 AM
  • It actually does, good to know

    This post is provided AS IS with no warranties or guarantees, and confers no rights.
    ~~~
    Questo post non fornisce garanzie e non conferisce diritti

    Friday, July 17, 2015 12:06 PM