|Working with policies / Assign policies|
Policies are always assigned to an OU, a domain or a workgroup. They apply by default to all groups in those container objects (.Authenticated users and .Authenticated computers groups are displayed in the activation area).
However, you can also define policies and activate them for one or more groups. These policies then apply exclusively to these groups.
This policy now applies exclusively to this group.
If policies have also been assigned to the higher-ranking OU, this policy applies to this group in addition to those defined for the whole OU.