Windows 2000 Group Policy Blocking and Enforcement

Microsoft Windows 2000 processes Group Policy Objects (GPOs) through a defined hierarchical order, but administrators can alter this standard flow using policy inheritance blocking and enforcement settings. By default, policies pass down from Sites to Domains and through nested Organizational Units (OUs), with lower-level settings overwriting higher-level configurations. However, administrators can halt this flow using the "Block Policy Inheritance" option or mandate compliance using the "No Override" setting. When these two rules conflict, Windows 2000 prioritizes enforcement over blocking, ensuring critical organizational policies always apply.

Standard Group Policy Processing Order

Windows 2000 processes Group Policy in a specific sequence known by the acronym LSDOU:

  1. Local: The local policy of the individual machine.
  2. Site: Policies linked to the Active Directory site where the computer resides.
  3. Domain: Policies linked directly to the Active Directory domain.
  4. Organizational Unit (OU): Policies linked to parent OUs, down through nested child OUs.

Under this default rule, policies processed later overwrite policies processed earlier if there are conflicting settings. Therefore, a setting configured at a child OU takes precedence over a conflicting setting defined at the Domain level.

Block Policy Inheritance

The "Block Policy Inheritance" setting is applied directly to an Active Directory container, specifically a Domain or an OU.

  • How it works: When enabled on a specific container, it prevents GPOs applied at higher levels in the Active Directory hierarchy (Sites, Domains, or parent OUs) from trickling down to that container and its child objects.
  • Scope: It acts as a blanket shield for the container. Instead of selectively blocking specific GPOs, it stops all upstream policy inheritance, leaving only the policies linked directly to that container (and any subordinate containers) to be processed.

The "No Override" Setting (Enforcement)

The "No Override" option (which was renamed to "Enforced" in Windows Server 2003 and later) is applied to a specific GPO link rather than a container.

  • How it works: When an administrator marks a GPO link as "No Override," the settings contained in that specific GPO cannot be overwritten by any lower-level GPO in the Active Directory hierarchy.
  • Scope: It protects critical enterprise configurations (such as global security rules) from being altered or superseded by departmental administrators managing downstream OUs.

How Windows 2000 Resolves Conflicts

When a container has enabled "Block Policy Inheritance," but a parent container contains a GPO marked with "No Override," Windows 2000 enforces the following rule:

  • "No Override" always takes precedence over "Block Policy Inheritance."

If a child OU enables "Block Policy Inheritance," it successfully stops all normal parent policies. However, any GPO link configured with "No Override" at the Domain or parent OU level will pierce through the block and apply to all objects within that child OU.

If multiple GPOs with "No Override" are linked at the same level or different levels and contain conflicting settings, the GPO highest in the Active Directory hierarchy wins. This guarantees that higher-tier administrative authority is preserved throughout the Windows 2000 domain structure.