nerdexam
GIAC

GSEC · Question #45

How are differences in configuration settings handled between Domain and Local Group Policy Objects (GPOs)?

The correct answer is B. Settings in the domain-wide GPO override conflicting settings in the local GPO on each computer.. In Active Directory environments, Group Policy is applied in LSDOU order (Local, Site, Domain, OU), meaning domain-level settings take precedence over local settings.

Windows and Malware

Question

How are differences in configuration settings handled between Domain and Local Group Policy Objects (GPOs)?

Options

  • ALocal and Domain GPOs control different configuration settings, so there will not be conflicts.
  • BSettings in the domain-wide GPO override conflicting settings in the local GPO on each computer.
  • CSettings in the local GPO override conflicting settings when the domain-wide GPO is applied.
  • DPrecedence depends on which GPO was updated first.

How the community answered

(20 responses)
  • A
    5% (1)
  • B
    75% (15)
  • C
    15% (3)
  • D
    5% (1)

Why each option

In Active Directory environments, Group Policy is applied in LSDOU order (Local, Site, Domain, OU), meaning domain-level settings take precedence over local settings.

ALocal and Domain GPOs control different configuration settings, so there will not be conflicts.

Local and domain GPOs can and do manage many of the same settings such as password policies and user rights, so conflicts are entirely possible.

BSettings in the domain-wide GPO override conflicting settings in the local GPO on each computer.Correct

Domain GPOs override local GPOs because Group Policy is processed in LSDOU order - Local, Site, Domain, then Organizational Unit. When a domain GPO and a local GPO define conflicting settings, the domain GPO values win because it is processed after the local GPO, effectively overwriting any conflicts.

CSettings in the local GPO override conflicting settings when the domain-wide GPO is applied.

Local GPO settings are processed first in the LSDOU hierarchy, so domain GPO settings override local GPO settings - not the other way around.

DPrecedence depends on which GPO was updated first.

GPO precedence is determined by the fixed LSDOU processing order, not by which GPO was most recently updated.

Concept tested: Group Policy Object LSDOU processing order and precedence

Source: https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/group-policy/group-policy-overview

Topics

#Group Policy#GPO precedence#domain policy#local policy

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GSEC Practice