Handling Enforced GPOs with Block Inheritance in AD DS

The scenario involves a conflict between two GPOs: 'Security Baseline' linked to the domain with Enforced enabled, and 'Kiosk Baseline' linked to the Kiosks OU. In Active Directory Group Policy processing, the order of precedence is determined by scope (Local, Site, Domain, OU) and specific link properties. The default behavior is that settings from higher-level scopes (like Domain) apply to lower-level scopes (like OU), unless blocked. However, the 'Enforced' property changes this dynamic.

When a GPO link is set to Enforced, it cannot be overridden by Block Inheritance settings on child OUs. This means that even if you block inheritance on the Kiosks OU, the Security Baseline GPO will still apply because its Enforced status forces it to take effect at all levels below the link. Therefore, Option C (Block inheritance for Kiosks) is incorrect because it fails to prevent Security Baseline from applying to the Kiosks computers.

To ensure that the Kiosks OU receives the unique settings from 'Kiosk Baseline' while preventing the general 'Security Baseline' settings from overriding them or causing conflicts, we must alter the application logic. Since blocking inheritance doesn't work against Enforced GPOs, the alternative is to make the specific GPO apply more broadly or adjust the enforcement. However, linking 'Kiosk Baseline' to the domain (Option D) would make it apply to all computers, not just kiosks, violating the requirement for specificity. Selecting Enforced for Kiosk Baseline (Option A) does not solve the precedence issue; it just makes the Kiosk GPO stronger but doesn't stop Security Baseline from applying simultaneously, potentially leading to conflicts where both sets of policies are active.

The correct approach in many exam scenarios involving Enforced GPOs where you want to isolate an OU from a domain-wide enforced policy is actually to recognize that Enforced GPOs always apply. Wait, let's re-evaluate. If Security Baseline is Enforced, it applies everywhere. To have Kiosks receive Kiosk Baseline settings, those settings must take precedence or replace the conflicting ones. But the question asks what to do so they receive settings from Kiosk Baseline. Usually, this implies ensuring the Kiosk settings are applied without interference. If Security Baseline is Enforced, it applies. If we block inheritance, it still applies. So how do we prioritize?

Actually, there is a nuance. If the goal is to have the Kiosk Baseline settings apply instead of or alongside the Security Baseline, we need to manage the link order. But looking at the options, none change link order. Let's look at Option B: Clear Enforced for the Security Baseline link. If we clear Enforced, then the Security Baseline is no longer forced. Then, if we also Block Inheritance on the Kiosks OU, the Security Baseline will NOT apply to the Kiosks OU, allowing the Kiosk Baseline to be the primary source for those computers. This satisfies the condition: Kiosks get Kiosk Baseline (and not Security Baseline), and other computers continue to get Security Baseline (since it remains linked to the domain and is no longer enforced, but still applies normally). Thus, clearing Enforced is the necessary step to allow Block Inheritance to function effectively for this specific OU.