Applying GPOs to objects in different OUs

Posted By: W3bbo | Aug 11th @ 10:17 AM
page 1 of 1
Comments: 3 | Views: 599
#Aug 11th @ 10:17 AM
W3bbo
W3bbo
The Master of Baiters
I've got a GPO I want to apply to objects located under both the Computers container (what Type is it anyway?) and the Domain Controllers OU.

Should I create a new group containing all the computers and domain controllers and put it into a new OU and apply
 the GPO there, or is there a more cleaner approach?
#Aug 11th @ 12:08 PM
AndyC
AndyC
The computers container is not an OU, so you can't apply policies there.

If it has to apply to everything then you should apply policies at the domain level. Otherwise you shouldn't use the computers container and should move non-DCs to an OU instead (in a Server 2003 level Forest you can set the default location of computer accounts to be in an OU of your choice, which you should do).

Leave DC's in the default Domain Controllers OU, in any case, you don't want to start moving those around if you know what's good for you.
#Aug 11th @ 12:43 PM
W3bbo
W3bbo
The Master of Baiters
That works if it's a simple scenario (that matches mine, so thanks for the tip!) but what if the relation wasn't so simple? Would you have to use groups as aliases?
#Aug 11th @ 1:07 PM
AndyC
AndyC
You can either filter based on WMI (best), security groups (good) or link the policy in multiple OUs (messy but sometime necessary). That should cover just about every theoretical scenario.
page 1 of 1
Comments: 3 | Views: 599