Windows 2000 Local vs Domain GPO Processing

Microsoft Windows 2000 processes Group Policy Objects (GPOs) using a defined hierarchical order known as LSDOU (Local, Site, Domain, Organizational Unit). In this architecture, Local GPOs are processed first, followed sequentially by domain-level policies. Because the operating system applies subsequent policies on top of earlier ones, domain GPO settings universally overwrite conflicting local GPO settings, ensuring centralized enterprise management supersedes standalone machine configurations.

The LSDOU Processing Order

To understand how Windows 2000 balances local and domain policies, it is necessary to examine the order in which policy engines apply settings:

  1. Local: The local GPO stored directly on the individual Windows 2000 computer (%systemroot%\System32\GroupPolicy).
  2. Site: GPOs linked to the Active Directory site in which the computer resides.
  3. Domain: GPOs linked directly to the Active Directory domain.
  4. Organizational Unit (OU): GPOs linked to parent OUs, followed by child OUs containing the user or computer account.

How Local GPOs Are Processed

Every computer running Windows 2000 has exactly one Local GPO, regardless of whether it is joined to an Active Directory domain or operating in a workgroup. During system startup and user logon, the Windows 2000 Group Policy engine reads the Local GPO first. It establishes the baseline configuration for security settings, administrative templates, and system scripts before network communication with domain controllers takes precedence.

How Domain GPOs Are Processed

Once the Local GPO is evaluated, the system contacts an Active Directory domain controller to retrieve policies assigned to the computer's location within the directory hierarchy. Windows 2000 downloads and executes Site-level GPOs, then Domain-level GPOs, and finally any applicable OU-level GPOs. Each successive layer of policy is processed into the registry, modifying or replacing settings applied by preceding layers.

Conflict Resolution Between Local and Domain GPOs

  • Non-Conflicting Settings: If a Local GPO defines a setting that is unconfigured in any domain-level GPO, the local setting remains active and enforceable on the machine.
  • Conflicting Settings: If a domain GPO defines a setting differently than the Local GPO, the domain setting overwrites the local setting. The last policy applied always wins under default behavior.
  • Inheritance Rules: Windows 2000 includes features such as "Block Policy Inheritance" and "No Override" (later renamed "Enforced" in modern Windows versions). However, these mechanisms apply exclusively to Active Directory containers (Sites, Domains, and OUs). A Local GPO cannot block domain inheritance, nor can it override domain-level enforcement under any circumstances.