Sites, Domains, and Organizational Units
As we mentioned above, GPOs can be linked only to the Site, Domain, and OU 'containers'. Sites and Domains are default objects, but specific Organizational Units must be created. Most enterprise Administrators base their OUs on existing department names, ie: Accounting, Helpdesk, HR, Executive, etc. and then create GPOs with set policies that explicitly apply to each group and their various needs. Even if explicit policies do not need to be enforced, many will create the OUs to simplify any future changes and maintain a logical organizational structure.
When you link multiple GPOs to a single object, like the Domain, policies are enforced in an order that you specify. This order is called "Link Order", and the lowest link order is processed last, and therefore has the highest precedence. It may take some time to get used to the counter-intuitive idea that the lowest is the most important, but you'll get there eventually. Defined policies with higher precedence will overwrite ones with lower precedence if there is any conflict. However, undefined policies are not considered. If the GPO with the lowest precedence enforces the Account Lockout Policy, and all of the higher precedence GPOs leave it Undefined, then the policy will be enforced. If, however, one of the higher precedence GPOs specifically defines not to enforce the Account Lockout Policy, then the policy will not be enforced.
Lastly, Group Policy is processed in a specific order across the entire network. That order is as follows:
1. Local GPO - A GPO on a single computer is processed first (and therefore has lowest priority).
2. Site - Any GPOs linked to a site are processed next.
3. Domain - GPOs linked to individual domains are processed third.
4. OU - GPOs linked to OUs are processed last, and therefore have the highest priority. This allows for maximum flexibility in enforcing various GPOs on individuals or departments.
You can view the effective policies on any Site, Domain, or OU by selecting its Group Policy Inheritance tab.