Two settings can bend the normal LSDOU order: an OU can Block Inheritance and refuse everything from above, and a link can be Enforced so nothing below can refuse or overwrite it. When both are used in the same tree, Enforced wins — here is the full set of rules.
In the normal LSDOU order, settings flow down from the domain to the OUs, and the last writer wins. Two switches exist for the days that flow is wrong. Block Inheritance, set on an OU, says: “GPOs from above this point do not enter here.” Enforced, set on a GPO link, says: “This policy applies no matter what — it cannot be blocked, and later GPOs cannot overwrite it.” Used rarely and deliberately, they protect real requirements. Used casually, they create the famous haunting: a policy that ignores every rule you know.
Example — Block Inheritance stops ordinary GPOs, but an Enforced GPO passes through the block and cannot be overwritten below it.
Right-click an OU in GPMC and choose Block Inheritance, and a blue exclamation mark appears on the OU. From that moment, GPOs linked to the site and the domain (and to parent OUs above the block) do not apply to accounts in that OU. Only GPOs linked directly to the OU itself — and below it — still work, plus any Enforced links from above.
The legitimate use is a genuinely separate world: a lab OU, a servers OU with its own complete rule set, where inheriting office-wide settings would break things. The illegitimate use — the one that causes hauntings — is blocking inheritance to "fix" one annoying setting. You did not fix one setting; you silently disconnected every present and future domain policy, including security baselines nobody remembers are being blocked.
Right-click a GPO link and choose Enforced, and two things change. First, the GPO now flows through Block Inheritance as if the block was not there. Second, its settings cannot be overwritten by GPOs processed later — the normal last-writer-wins rule is suspended for it. Enforced exists for non-negotiables: the password policy baseline, a legal requirement, a security setting that no department may soften.
What if two enforced GPOs conflict? The one linked higher in the hierarchy wins — a domain-level enforced GPO beats an OU-level enforced GPO, because among enforced policies the processing effectively reverses: the higher link is treated as the final authority. This surprises everyone the first time, so write it down: enforced vs enforced → higher link wins.
With both switches in play, a target account's winning setting is decided like this, weakest to strongest:
Notice what is not on this ladder: the Default Domain Policy has no magic priority, and a GPO being "important" changes nothing. Only position, link order, and these two switches decide outcomes — which is good news, because all of them are visible in GPMC if you know where to look.
A policy applying despite being "removed". A domain baseline that mysteriously skips one OU. A setting that will not change no matter what the OU GPO says. Before doubting LSDOU itself, open GPMC and check three things: the blue exclamation mark (Block Inheritance) on every OU above the account, the padlock icon on links (Enforced), and the Group Policy Inheritance tab on the OU, which lists exactly which GPOs will apply after all blocks and enforcement are resolved — in precedence order. That tab is the ground truth; when your mental model and the tab disagree, believe the tab and find the switch you forgot.
User policy and computer policy explained live on a real domain controller — create, link and test your first GPO with the video.
▶️ Watch Full VideoNo. Enforced links pass straight through Block Inheritance — that is precisely what Enforced is for. Block Inheritance only stops ordinary, non-enforced GPOs linked above the OU.
The GPO linked higher in the hierarchy wins — for example, a domain-level Enforced GPO beats an OU-level Enforced GPO. This is the reverse of the normal last-writer-wins rule and catches many admins out.
Select the OU in GPMC and open the Group Policy Inheritance tab. It shows the exact list of GPOs that will apply to that OU, in precedence order, after Block Inheritance and Enforced have been taken into account.