Windows 2000 Computer Policy Processing at Startup

This article explains how Microsoft Windows 2000 processes and overrides Computer Configuration Group Policies during the operating system boot process. It covers the initial network initialization, the standard hierarchy of inheritance (LSDOU), and the specific mechanisms—such as "No Override," "Block Policy Inheritance," and Security Group filtering—that dictate how policy conflicts are resolved before a user logs on.

The Startup Processing Sequence

When a Windows 2000 computer boots, it processes the Computer Configuration portion of Group Policy synchronously before displaying the "Press Ctrl+Alt+Delete" logon dialog.

  1. Network and Directory Discovery: The system initializes core networking services and uses DNS and Kerberos to locate a domain controller.
  2. Policy Engine Invocation: The Group Policy engine (userenv.dll) retrieves the list of applicable Group Policy Objects (GPOs) associated with the computer account in Active Directory.
  3. Synchronous Execution: By default, Windows 2000 halts the startup process until all computer-targeted extensions (such as Software Installation, Scripts, and Security Settings) have completely finished processing.

The Standard Precedence Order (LSDOU)

Windows 2000 applies policies in a specific sequence known as LSDOU:

  1. Local: The local computer policy is applied first.
  2. Site: Policies linked to the Active Directory site where the computer resides are applied next.
  3. Domain: Policies linked to the domain containing the computer account are applied third.
  4. Organizational Unit (OU): Policies linked to parent OUs and then nested child OUs are applied last.

Under normal rules of precedence, policies applied later in the sequence overwrite conflicting settings applied earlier. Therefore, a setting defined at the child OU level overrides a conflicting setting set at the Domain, Site, or Local level. If multiple GPOs are linked to the same container, they are processed in reverse link order (the GPO with Link Order 1 has the highest priority and is applied last, overriding others).

Overriding the Default Inheritance Rules

Windows 2000 provides administrative settings to alter this bottom-up override behavior:

1. "No Override" (Enforced)

An administrator can flag a specific GPO link with the No Override option at a higher level (such as the Domain or a parent OU). When enabled:

  • The settings within that GPO cannot be overwritten by any lower-level container (such as a child OU).
  • If a conflict occurs between a parent GPO set to "No Override" and a child OU GPO, the parent GPO takes precedence.
  • If multiple parent GPOs have "No Override" configured, the one higher in the directory hierarchy takes precedence.

2. "Block Policy Inheritance"

An administrator can configure an OU to Block Policy Inheritance. When set:

  • The container ignores all policies inherited from parent OUs, Domains, or Sites.
  • Only GPOs linked directly to that specific OU (or its sub-OUs) are applied.
  • Exception: If a higher-level GPO has No Override enabled, that policy bypasses the inheritance block and is applied regardless.

3. Security Group Filtering

Before any GPO is applied to the computer during startup, Windows 2000 checks the computer account's permissions against the GPO's Access Control List (ACL). To process and apply the policy, the computer account must have both Read and Apply Group Policy permissions. If these permissions are denied or missing for the computer account, the GPO is bypassed entirely, preventing any overrides defined in that GPO from taking effect.