Yes, that should work. I see you do have a non-security-filtered GPO after all and you correctly have it at the bottom.
-----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of Michael Leone Sent: Monday, June 19, 2017 11:19 AM To: [email protected] Subject: Re: [NTSysADM] Q about GPO Security Filtering precendence On Mon, Jun 19, 2017 at 11:04 AM, Michael Leone <[email protected]> wrote: > > I'm confused. From searching, I thought that the *last* listed GPO takes > precedence. > > So wouldn't I want my non-rebooting (notify only) GPO *first*, applying to > all "WSUS Members", and my rebooting schedule #1 GPO (applying to "WSUS > Members" and the new AD group? > > If I had the order the other way (9AM first, then the non-rebooting), > wouldn't the non-rebooting GPO override the settings from the GPO above > it? Further research says that is not so. Apparently, the GPO with link #1 gets applied *last*. https://www.markwilson.co.uk/blog/2004/09/priority-order-for-application-of-gpos.htm So in my case, as Charles says, I will want this order: 1. Install-at-9AM (only certain group members get these settings) 2. Install-at-930AM (only certain group members get these settings) 3. Install-at-10AM (only certain group members get these settings) 4. All WSUS Members, notify only, no download (so they all get this setting, except for the ones who got the setting from above it)
