Four GPOs set four different wallpapers for the same user. Only one wallpaper appears. LSDOU is the rule that decides which one — Local first, then Site, then Domain, then OU, with the last one applied winning every conflict.
Group Policy conflicts are not errors — they are the normal state of a real domain. The domain policy says one thing, the department OU says another, and the PC obeys a strict referee called LSDOU: Local, Site, Domain, OU. Policies are processed in that order, and when two of them set the same thing, the one processed later wins. This means the OU — the most specific container — normally has the final word. Once you can predict the winner before you test, GPO work stops being guesswork.
Example values — only one setting is shown, but every conflicting setting in every GPO is settled by this same last-writer-wins rule.
gpedit.msc. Weakest layer; almost anything from the domain overwrites it.The logic is deliberate: broad rules at the top (domain), specific exceptions at the bottom (OU). Set the company-wide baseline in the domain policy and let each department fine-tune in its OU.
OUs often nest: an Office OU contains an Accounts OU, which contains a Trainees OU. Processing walks down the tree: the parent OU's GPOs apply first, then the child's, so the deepest OU wins. If the Office OU sets a 5-minute screen lock and the Trainees OU sets 2 minutes, trainees get 2 minutes — their GPO was processed last.
Two or more GPOs linked to the same OU follow the link order shown in GPMC: the GPO with link order 1 has the highest precedence on that OU and is processed last among them. When two same-OU GPOs conflict, drag the one that must win to link order 1.
LSDOU runs twice for every machine: once through the computer's containers for the computer half (at boot), and once through the user's containers for the user half (at logon). A PC in the Training-Room OU gets that OU's computer settings; a manager logging onto it still brings the Managers OU's user settings, because her account lives there. This is why "the policy on this PC" is a meaningless phrase until you ask: the computer's policies, or the logged-on user's?
You can watch the race results any time: gpresult /h report.html shows, for every setting, the winning GPO — the exact GPO whose value survived. When a setting surprises you, that report names the GPO responsible, and the mystery is over.
LSDOU is the default, but two switches rewrite it. Block Inheritance on an OU stops GPOs from above (site and domain) from flowing down into it. Enforced (older name: No Override) on a link makes that GPO immune — it cannot be blocked and cannot be overwritten by later GPOs; if two enforced GPOs conflict, the one linked higher in the tree wins. Both tools are powerful and both cause "impossible" results when forgotten — they have their own guide in this series.
Honest advice: in a small office you may never need either one. If your LSDOU prediction and the PC disagree, check for these two switches before you doubt the order itself — a forgotten Block Inheritance from two years ago is a classic culprit.
Make this a habit and GPO work becomes engineering instead of luck:
gpresult /h report.html and compare.Nine times out of ten the prediction is right, and the tenth time the exception hunt teaches you something real about your own domain.
User policy and computer policy explained live on a real domain controller — create, link and test your first GPO with the video.
▶️ Watch Full VideoLocal, Site, Domain, Organisational Unit — the order in which Group Policies are processed. Each layer can overwrite conflicting settings from the layer before it, so the OU, processed last, normally wins.
The GPO with the lowest link order number (link order 1) has the highest precedence on that OU and is processed last, so its setting wins. You can drag links up and down in GPMC to change the order.
Run gpresult /h report.html on the PC and open the report. For every setting it shows the winning GPO — the one whose value was applied last — which tells you exactly where to edit if the value is wrong.