Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Scenario: OU has three GPOs applied to it. There are three sub-OU's beneath this OU, all of which inherit the aforementioned GPOs.

Sub-OU #2 needs to be prevented from inheriting ONE of the three GPOs from the main OU. How can this be done without blocking inheritance on Sub-OU two, which would result in all three GPOs being blocked?

share|improve this question

1 Answer 1

This reads like a question straight from my MCITP tests.

A picture might help, but if I understand correctly, you can either do this via security filtering, create a group and put security principals in this group to which you do not want this GPO to apply, and then configure the security filtering on that one GPO appropriately,

or, the dirtier way to do it would be to link another GPO to the sub-OU that overrides the settings in the higher OU. But again, that's a pretty poor solution.

You could also block inheritence on the sub-ou, and then link the other two GPOs again directly to the sub-ou.

I like my third solution the best. :)

share|improve this answer
    
Yes, agreed - your third solution is the most elegant. I implemented the change and am just waiting for confirmation that it has worked as planned. –  Citizen Chin Jan 9 '12 at 15:09

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.