Applying Group Policy to Groups

[stompin]

OK can I setup a GP and apply the GP to an OU without any objects in the OU and just use the GP filter function by selecting groups of users and or computers I want the GP to be applied to? In other words create an OU called test, keep the OU empty of any AD objects, create a GP and under the permissions list just apply the GP to a group called XP Machines. Will this GP then apply to the members of XP Machines??

Hope that makes sense..!

stompin

 

[jdyer]

I don't think so. I think the GP only applies to the AD Objects under that OU. I could be wrong though.

 

[ITPangaeaArchitect]

no it would not...you would have to be using loopback mode, which could only be done if the computer or user object is in the OU the policy is set on....in that case you could use loopback in merge or replace mode to get user settings onto that computer from a different OU

short of that, the L-S-D-OU methodology still applies...there is no search for random policies that are not linked within the upper tree limbs of the object the policy is being applied to

-Brandon Wilson
MCSE00/03, MCSA:Messaging, MCSA03, A+
almost got a paragraph there

 

[Seaspray0]

Group Policy is applied only to the objects in the container that the Policy is applied to (this includes SUB OU's). The only valid objects are USERS and COMPUTERS. The two parts of the policy are applied to their counterparts... user policy only applies to user objects, computer policy only applies to computer objects. Computer policy is applied when the PC starts, and user policy is applied after the user supplies his/her credentials at login. Policies are applied in the order: local, site, domain, OU, Sub OU. Any settings that are specified in a policy will overwrite settings specified in a previous policy.

If you wish to generate a policy that only applies to a particular group, you should apply that policy to the container that holds all the computers or users that will be in that group (i.e. domain level). Then, with the advanced view, you adjust the permissions on the policy... you can specify which groups to "apply policy" (its a security permission), you can even deny "apply policy" to a particular group (i.e. admins) to prevent the policy from applying to them.

Hope this helps.

A+/MCP/MCSE/MCDBA

 

[stompin]

Thanks to all of you for the advice. I am happy using GP but my setup here at work would benefit from being able apply GP's to groups which exist outside of containers - oh well.

stompin