[ActiveDir] Block Inheritance on DC OU

[WATSON, BEN]

The company I am currently working for has “block inheritance” enabled for the Domain Controller’s OU and apparently whoever enabled this setting is no longer with the company (or they won’t fess up to why they did this).   Although I am curious, what sort of ramifications does enabling “block inheritance” on the Domain Controller’s OU pose?  And what reason would you have to enable this setting on the Domain Controller’s OU?  With any other OU, it would be fairly obvious, but being that these are the Domain Controllers it would seem to be a unique situation.   Thanks as always for your input, ~Ben