GPOs link to Sites, Domains, or OUs. They apply in order: Local → Site → Domain → OU (LSDOU). Last writer wins.
RSOP (gpresult /h report.html) shows the actual policy on a target machine — invaluable when something isn't applying.
Keep GPOs scoped and named clearly: 'Workstation - BitLocker' beats 'New GPO (Group Policy Object) 12'.