Recipe 9.13 Blocking Inheritance of GPOs on an OU

9.13.1 Problem

You want to block inheritance of GPOs on an OU.

9.13.2 Solution

9.13.2.1 Using a graphical user interface

1. Open the GPMC snap-in.

2. In the left pane, expand the Forest container, expand the Domains container, and browse to the target domain.

3. Right-click on the OU you want to block inheritance for and select Block Inheritance.

9.13.2.2 Using VBScript

' This code blocks inheritance of GPOs on the specified OU ' ------ SCRIPT CONFIGURATION ------ strDomain   = "<DomainDNSName>" ' e.g. rallencorp.com strOU      = "<OrgUnitDN>"      ' e.g. ou=Sales,dc=rallencorp,dc=com boolBlock  = TRUE               ' e.g. set to FALSE to not block inheritance ' ------ END CONFIGURATION --------- set objGPM = CreateObject("GPMgmt.GPM") set objGPMConstants = objGPM.GetConstants( )    ' Initialize the Domain object set objGPMDomain = objGPM.GetDomain(strDomain, "", objGPMConstants.UseAnyDC) ' Find the specified OU set objSOM = objGPMDomain.GetSOM(strOU) if IsNull(objSOM) then    WScript.Echo "Did not find OU: " & strOU    WScript.Echo "Exiting."    WScript.Quit else    WScript.Echo "Found OU: " & objSOM.Name end if ' on error resume next objSOM.GPOInheritanceBlocked = boolBlock if Err.Number <> 0 then    WScript.Echo "There was an error blocking inheritance."    WScript.Echo "Error: " & Err.Description else            WScript.Echo "Successfully set inheritance blocking on OU to " & boolBlock end if

9.13.3 Discussion

By default, GPOs are inherited down through the directory tree. If you link a GPO to a top-level OU, that GPO will apply to any objects within the child OUs. Sometimes that may not be what you want, and you can disable inheritance as described in the solutions.

Try to avoid blocking inheritance when possible because it can make determining what settings should be applied to a user or computer difficult. If someone sees that a GPO is applied at a top-level OU, they may think it applies to any object under it. Using the Resultant Set of Policies (RSoP) snap-in can help identify what settings are applied to a user or computer (see Recipe 9.20).

9.13.3.1 Using VBScript

To block inheritance, I first have to get a GPMSOM object for the OU by calling the GPMDomain.GetSOM method. The only parameter to this method is the DN of the OU (or leave blank to reference the domain itself). Next, I call the GPMSOM. GPOInheritanceBlocked method, which should be set to either TRUE or FALSE depending if you want inheritance blocked or not.

9.13.4 See Also

MSDN: GPMDomain.GetSOM and MSDN: GPMSOM.GPOInheritanceBlocked