Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm having a bit of a hard time understanding the scope of GPOs, links, and security filters.

From what I understand, then LINK establishes to whom the GPO may apply to and that the security filter sets who it actually does apply to (with the limitation of only being able to apply the GPO to objects that fall underneath what is linked to it). Please correct me if I'm wrong.

So my situation is, I've recently installed WSUS. Under my domain I created an OU for Computers, then OUs within it for each department, and then the actual computer objects go within each of those department OUs respectively.

Ideally, I'd love to edit my GPO, go to the Security Filtering and say "Apply this to GPO to all the computers in the Finance, Marketing, and Sales OUs". Unfortunately, the Security Filter only works with Users, Groups, and Computers... not OUs (meaning I'd have to either create groups for each OU or select computers individually, neither of which I want to do).

So now that I've departmentalized my computers into OUs, how can I most efficiently apply the WSUS GPO to the computers in the Finance, Marketing, and Sales OUs?

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

The default security filter for a GPO is to apply to the group Authenticated Users; this includes all users and computers in the domain.

Set the security filter back to containing Authenticated Users, then link the GPO to the desired OUs (and make sure it's not linked anywhere that you don't want it).

share|improve this answer
    
Ok, So the Filter being set to Authenticated Users allows anyone, but the LINK sets the scope of that? So if my Finance OU has 5 computers in it and I link the GPO only to that OU and then set the Filter to Authenticated Users, it will apply the GPO to those 5 computers only? –  Safado Apr 14 '11 at 14:50
1  
@Ryan Correct. The way to think about it is "All GPOs linked to parent OUs of an object will apply, with GPOs closer to the object taking precedence (except when a higher one is in "enforce" mode), as long as the object is in the GPO's security filter". –  Shane Madden Apr 14 '11 at 15:02
    
Awesome, it all makes sense now! Thank you! –  Safado Apr 14 '11 at 15:23
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.