GPOs linked to a container apply to all objects that are contained by the container. Additionally, ACEs set on a parent OU may inherit down to child objects.
## Opsec Considerations
Creation and modification of ACEs will be logged depending on the auditing setup on Domain Controllers.
## References
* [https://wald0.com/?p=179](https://wald0.com/?p=179)
* [https://blog.cptjesus.com/posts/bloodhound15](https://blog.cptjesus.com/posts/bloodhound15)