Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Are there other ways in Active Directory to organize computer objects for Group Policy application besides OU?

How could one apply a policy only to certain computers in many disparate OUs? I'm looking for something akin to the Collections metaphor within SCCM, where a computer can belong to many groups.

share|improve this question
add comment

4 Answers 4

up vote 4 down vote accepted

The way I do it is to Put the GPO as far down the directory structure so that it covers all of the OU's that you want it to effect. Then you can setup filter based on Security group or WMI queries.

If you aren't using Group Policy Management Console, i suggest you go grab it from Microsoft, it will make your life easier and you can set the filtering options via it's interface.

share|improve this answer
add comment

You could attach the OU to a high enough OU to cover all the computers, and then assign it to a group of computers rather than a group of users. The computers pick up their machine settings at startup (and other times depending on your refresh settings).

share|improve this answer
add comment

WMI Filters are your friend.

http://support.microsoft.com/kb/555253

share|improve this answer
add comment

An additional option is to link the GPO to multiple OU's; however, Zypher's answer is the best option if you don't want the policy to apply to all computers in an OU.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.