0

Do local group policies apply to active directory users? Can you force the local policies (or registry keys) to apply to a domain user that has yet to long on to a machine without the use of the AD GPO? Is there a programmatic way to do this?

Improve this question

3 Answers 3

Reset to default
1

Domain Group Policies and Local Group Policies applied to computer in domain and to user in domain in following order:

  1. Local Computer Policy (low priority)

  2. Domain Group Policy (middle priority)

  3. Organization unit Domain Group Policy (strong priority)

For example: if you set some option in "1" and this option isn't set in "2" and "3" - this option will be applied to your computer.

But if you set some option in "1" and this option has already set in "2" or "3". Your option will overrided and "2" or "3" will be applied.

P.S. "3" will override "2" and "1" as well.

To check what parameters that your computer applied from domain your can press Win+R ("Run") and execute following command: rsop.msc

Improve this answer
2

The simple answer is yes, local policies apply to all users on the machine. You should review the Microsoft Group Policy precedence carefully to understand how policies are applied.

With that said, there's rarely a good argument for using Local Group Policies in a domain environment.

Improve this answer
3
  • I understand this. But we are managing the computers themselves. We have no control over the domain, so it's imperative that we force the local settings upon any user logging into the machine. Commented Nov 3, 2016 at 13:27
  • "How do I make a manual transmission car shift automatically?" You don't. Commented Nov 3, 2016 at 15:25
  • Additionally group polices are applied every 90 minutes in the default configuration (See here: Group Policy refresh interval for computers ) so even if you could force/manipulate local policies they could be overwritten again. Commented Nov 10, 2016 at 12:14
-3

By default, local group policies will (decide if they) win over the AD group policy, but be aware that AD group policy can be configured to win if it sets 

Computer Config>Admin Templates>System>Group Policy>Configure user Group Policy loopback processing mode

to disabled.

Improve this answer
0

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.