P. 180 states "the Default Domain Policy GPO cannot be blocked." However I've found this is not the case, at least in Windows 2000 native mode Active Directory. It appears this assertion is only made in Chapter 4, and not in Chapter 6.