Gurus,

Say you have a domain with a domain policy, and an OU in that domain that
has two special Group Policies (GPOs) defined just for it. When one
right-clicks the OU, selects Properties, Group Policy tab, the GPOs are
right there in the main Window. Now, since we have two GPOs for this OU,
one on top and one on the bottom, we know that the one higher in the list
(in this case, the one on top) takes precedence, so if there is a conflict
between any one setting of the two, the one higher in the list gets it's
setting applied. But the one in the bottom of the list gets it's settings
applied last, so for any setting in a GPO higher in the list which is "Not
Configured", any setting in a lower GPO which is set to something specific
will then be the setting that takes effect for objects in that OU. Am I
correct in how I am understanding all this?

Yes You are correct. Also If settings conflict (settings
are defined in multiple GPO's) The setting in GPO applied
last takes effect.

One Other thing: If Settings are undefined in a lower
level OU, but there are specific settings defined at a
higher level (site, domina, parent OU/s) the settings from
the higher level GPO's will take effect on the lower level
OU with the undefined settings. You can prevent this by
Checking Block Policy Inheritance on the lower level OU
(Which means that OU starts with a clean slate, no
inherited settings from higher level GPO's).


GPO's are applied in the following order:
Local Machine, Site, Domain, OU's. The lowest level OU is
applied last and its settings can override any higher
level GPO..