Recipe 9.13 Blocking Inheritance of GPOs on an OU

9.13.1 Problem

You want to block inheritance of GPOs on an OU.

9.13.2 Solution

9.13.2.1 Using a graphical user interface

Open the GPMC snap-in.
In the left pane, expand the Forest container, expand the Domains container, and browse to the target domain.
Right-click on the OU you want to block inheritance for and select Block Inheritance.

9.13.2.2 Using VBScript

' This code blocks inheritance of GPOs on the specified OU
' ------ SCRIPT CONFIGURATION ------
strDomain   = "<DomainDNSName>" ' e.g. rallencorp.com
strOU      = "<OrgUnitDN>"      ' e.g. ou=Sales,dc=rallencorp,dc=com
boolBlock  = TRUE               ' e.g. set to FALSE to not block inheritance
' ------ END CONFIGURATION ---------

set objGPM = CreateObject("GPMgmt.GPM")
set objGPMConstants = objGPM.GetConstants( )
  
' Initialize the Domain object
set objGPMDomain = objGPM.GetDomain(strDomain, "", objGPMConstants.UseAnyDC)

' Find the specified OU
set objSOM = objGPMDomain.GetSOM(strOU)
if IsNull(objSOM) then
   WScript.Echo "Did not find OU: " & strOU
   WScript.Echo "Exiting."
   WScript.Quit
else
   WScript.Echo "Found OU: " & objSOM.Name
end if

' on error resume next

objSOM.GPOInheritanceBlocked = boolBlock

if Err.Number <> 0 then
   WScript.Echo "There was an error blocking inheritance."
   WScript.Echo "Error: " & Err.Description
else        
   WScript.Echo "Successfully set inheritance blocking on OU to " & boolBlock
end if

9.13.3 Discussion

By default, GPOs are inherited down through the directory tree. If you link a GPO to a top-level OU, that GPO will apply to any objects within the child OUs. Sometimes that may not be what you want, and you can disable inheritance as described in the solutions.

Try to avoid blocking inheritance when possible because it can make determining what settings should be applied to a user or computer difficult. If someone sees that a GPO is applied at a top-level OU, they may think it applies to any object under it. Using the Resultant Set of Policies (RSoP) snap-in can help identify what settings are applied to a user or computer (see Recipe 9.20).

9.13.3.1 Using VBScript

To block inheritance, I first have to get a GPMSOM object for the OU by calling the GPMDomain.GetSOM method. The only parameter to this method is the DN of the OU (or leave blank to reference the domain itself). Next, I call the GPMSOM. GPOInheritanceBlocked method, which should be set to either TRUE or FALSE depending if you want inheritance blocked or not.