You want to block inheritance of GPOs on an OU.
Open the GPMC snap-in.
In the left pane, expand the Forest container, expand the Domains container, and browse to the target domain.
Right-click on the OU you want to block inheritance for and select Block Inheritance.
' This code blocks inheritance of GPOs on the specified OU ' ------ SCRIPT CONFIGURATION ------ strDomain = "<DomainDNSName>" ' e.g. rallencorp.com strOU = "<OrgUnitDN>" ' e.g. ou=Sales,dc=rallencorp,dc=com boolBlock = TRUE ' e.g. set to FALSE to not block inheritance ' ------ END CONFIGURATION --------- set objGPM = CreateObject("GPMgmt.GPM") set objGPMConstants = objGPM.GetConstants( ) ' Initialize the Domain object set objGPMDomain = objGPM.GetDomain(strDomain, "", objGPMConstants.UseAnyDC) ' Find the specified OU set objSOM = objGPMDomain.GetSOM(strOU) if IsNull(objSOM) then WScript.Echo "Did not find OU: " & strOU WScript.Echo "Exiting." WScript.Quit else WScript.Echo "Found OU: " & objSOM.Name end if ' on error resume next objSOM.GPOInheritanceBlocked = boolBlock if Err.Number <> 0 then WScript.Echo "There was an error blocking inheritance." WScript.Echo "Error: " & Err.Description else WScript.Echo "Successfully set inheritance blocking on OU to " & boolBlock end if
By default, GPOs are inherited down through the directory tree. If you link a GPO to a top-level OU, that GPO will apply to any objects within the child OUs. Sometimes that may not be what you want, and you can disable inheritance as described in the solutions.
Try to avoid blocking inheritance when possible because it can make determining what settings should be applied to a user or computer difficult. If someone sees that a GPO is applied at a top-level OU, they may think it applies to any object under it. Using the Resultant Set of Policies (RSoP) snap-in can help identify what settings are applied to a user or computer (see Recipe 9.20).
To block inheritance, I first have to get a GPMSOM object for the OU by calling the GPMDomain.GetSOM method. The only parameter to this method is the DN of the OU (or leave blank to reference the domain itself). Next, I call the GPMSOM. GPOInheritanceBlocked method, which should be set to either TRUE or FALSE depending if you want inheritance blocked or not.
MSDN: GPMDomain.GetSOM and MSDN: GPMSOM.GPOInheritanceBlocked