Are group policies cumulative? If a GPO is assigned to the domain and then a separate GPO assigned to an OU, do features of the domain GPO filter down to the OU and apply with features set in the OU GPO as long as they don’t conflict?


If you have no GPOs that “conflict” anywhere in your Scope of Management (SOM), they will apply cumulatively. However, if you have a GPO which says to do one specific thing at, say, the Domain level, and another GPO which says to do a specific thing at, say, the OU level, the one “closer” to the user (or computer) will apply. So, here’s a simple example: You restrict the control panel at the domain level, but at the OU level you make it available. Since the GPO linked to the OU is “closer” to the target account, that is the setting that will take effect.