well... I had a pretty calm morning, so I had to go ahead and test it out.. heh!

These are my findings:

1. Domain GP (Account Policy) - OU GP (A.P.) = Domain GP wins
2. Domain GP with A.P. set to 0 tries lockout threshold (never lock out) - OU GP (A.P.) = Domain GP wins
3. No Domain GP (A.P.) - OU GP (A.P.) = BUG!? The last set Domain GP wins.. lol!

With other words, the Account Policy GP settings are only effective on the Domain GP level, it doesn't matter at all if you try to apply A.P. settings on the OU level.

However, I found a bug, where if you completely disable/uncheck the A.P. settings on the Domain, it won't disable the A.P. ! It will use what ever the policy was set to last.. heh!!

Maaan what a mess those Account Policies are.. !