How to apply GPOs to specific OUs?

[xAOx]

Ok this is my setup to prevent confusion:

Group Policy Management
+Forest: MyDomain.com
+Domains > MyDomain.com (with a blue exclamation point?)
>Default Domain Policy
>Desktop Change Policy (i created before)
> Domain Controllers (OU)
>Default Domain Controllers Policy
> Group Policy Objects
>Default Domain Policy
>Desktop Change Policy (i created)
>Default Domain Controllers Policy
> Terminal Group (OU)
>Terminal Members (Group)
Terminal rules (policy)
> WMI Filters
+Sites

Ok I am a Member Of; Administrators, Users, Terminal Members
Terminal Members can log into our terminal server remotely.
Since I am a member of Administrators, it is ok for me to have access rights and privileges to certain things. But Members Of "Users" and "Terminal Members" when logging remotely should have restrictions such as No control panel, Password length, etc.

In Terminal Group OU I created has the Terminal Members group and Terminal Rules policy... unfortunately it doesn't apply until I drag the policy and link it to the domain. But this is no good since everyone is effected by it except just employees who are Members of; Users and Terminal Members.

How do I filter out who gets what policy enabled? Please help.

 

[Spirit]

You just need to either create a OU for the terminal users or if that already exists just apply the GP to it.

Remember that some settings will ONLY apply at the domain level like password policies.

Iain

 

[xAOx]

Correct, but it seems like Terminal Servers OU, contains a Terminal rules policy that says No Access to control panel. So an Administrator who is a member of the Remote group that is in TS OU, also loses access to control panel.

I know I'm saying it in a confusing manner but basically how do I filter out some members of the Terminal group (who are not in the TS OU tho)?

 

[Spirit]

This is where GP could get messy, you could start playing with the inheritence rules and permissions to prevent user / group X from having that rule applied.

Or you could look at doing a loopback so the admin GP is reapplied after the Terminal Service one?

Again things get messy and complex when you start this.

Good Luck,
Iain