Question : Group Policy - domain controllers

Is it normal to have the 'scope' of the policy for domain controllers to include both the Default Domain controllers policy and the Default Domain policy as well?  I'm trying to disable the control panel on all domain PC's but I don't want that policy applied to the domain controller.  It seems that the default is to have the scope include both these policies for the Domain Controllers.  Or is that not the case?

It seems that no matter what I try, the default domain policy will override the default domain controller policy and disable access to the control panel on my domain controller(s).

Can someone help me better understand this process?

Thx!

Answer : Group Policy - domain controllers

OK, can there be multiple values for imagid like 100_1, 100_2, 100_4 ?

If so, which one will match, or do they all need updating ?