What this does
Computes which Group Policy Object actually wins when multiple linked GPOs set conflicting values for the same policy — accounting for the LSDOU processing order (Local, Site, Domain, Organizational Unit), per-level link order, Block Inheritance, and Enforced links, entirely in your browser.
Why Enforced + Block Inheritance is the part people get wrong
The two rules that trip people up most: Block Inheritance at an OU stops non-Enforced GPOs from any level above it from applying there — but an Enforced GPO ignores that block entirely, regardless of level. And when two Enforced GPOs conflict with each other, the normal "closest to the object wins" rule flips: the one set higher in the hierarchy (closer to the domain root) wins instead. Reasoning through both interactions by hand across more than two or three levels is exactly the kind of thing worth checking with a calculator rather than trusting a mental model.
FAQ
What does LSDOU actually stand for?
Local, Site, Domain, OU — the order Group Policy processes GPOs in, from broadest to most specific. Settings from later-processed levels overwrite conflicting settings from earlier ones by default, which is why an OU-linked GPO normally wins over a Domain-linked one for the same setting.
Why does link order 1 win instead of the highest number?
Link order describes processing order, and later-processed GPOs at the same level overwrite earlier ones — but Windows numbers link order with 1 as the highest precedence, processed last, specifically so administrators read "link order 1" as "this one wins" without needing to remember which direction the underlying processing sequence runs.
If Block Inheritance blocks a Domain GPO, why would I ever mark that GPO Enforced instead of just accepting the block?
Block Inheritance is usually set by whoever manages a specific OU, to keep that OU's own policies from being overridden by anything above it. Enforced is the domain (or higher-level) administrator's override of that — a way to guarantee a specific security-critical setting applies everywhere, regardless of what any OU administrator downstream has configured. The two exist specifically to counterbalance each other across different levels of delegated administration.
Why does the precedence order reverse for Enforced GPOs specifically?
For ordinary GPOs, the setting closest to the actual object should win, since it's presumably the most specific and intentional. For Enforced GPOs, the opposite logic applies: they exist to guarantee a policy set higher in the hierarchy can't be overridden by anything more specific, so when two Enforced GPOs conflict, the one set at the higher, more centrally-managed level wins.
Does this account for WMI filters or security filtering on a GPO?
No — this calculator only models the LSDOU order, link order, Block Inheritance, and Enforced status. WMI filters and security group filtering determine whether a GPO applies to a given computer or user at all in the first place; this tool assumes every listed GPO does apply and computes precedence among those that do.
Try it yourself
For the full mechanics of how Group Policy processes and applies settings, see Group Policy Processing Explained.