Say you have a tree:


and you have two NSM policies, one associated with ou1 and the other with ou2.

I understand that the ou1 policy needs to have the block flag checked to
effect users in ou1 otherwise ou2's policy will affect them. Correct?

Am I right in understanding that NSM searches up the tree to the root and
the highest policy in the tree overrides lower policies unless the lower
policies have the 'block flag set?