How to inherit from Default Domain GPO?

You're misunderstanding what Group Policy Inheritance is and what it means. Group Policy Objects don't inherit settings from each other. Changes you make to one GPO are applicable to that GPO, other GPO's won't inherit the settings from another GPO.

I'm sure someone else here will post a lengthy and educational answer about Group Policy Inheritance, so I'll forego doing that myself. Suffice it to say, if you want to leave your Default Domain GPO untouched but want to create a new GPO that has all of the settings of the Default Domain GPO which you can then make changes to, then you can simply make a copy of the Default Domain GPO, rename it, and link it to the Domain. You can then make any changes you desire to this new GPO.


You are correct that it's generally advisable to leave the Default Domain GPO alone.

If I understand your question correctly, you want another GPO that is linked at the same level (i.e. to the domain at the top level,) but if there are any settings in your custom GPO that conflict with what is in the Default Domain GPO, then the settings in your custom GPO should take precedence.

In this case, what you want to look at is the link order of the GPOs.

The GPO with the lowest link order is processed last, and therefore has the highest precedence.

You can modify the link order of the GPOs in the Group Policy Management Console. They're just up and down arrows that re-order the GPOs. If your GPO has a link order of 1, then it is processed last, meaning that it takes precedence over other GPOs in that same context (linked at the same level,) or overwrites the Default Domain GPO only on settings that are configured in your custom GPO. For settings that you do not configure in your custom GPO, the settings in the Default Domain GPO (where configured) will still apply.