By putting exclusive lock on group policy file it's possible to stop group policy from applying domainwide.
vulners.com/securityvulns/securityvulns:doc:2247
vulners.com/securityvulns/securityvulns:doc:2728
vulners.com/securityvulns/securityvulns:doc:4017