Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I know I can set up an OU, move user objects in to it, and link a GPO to that OU and that GPO will apply to those users.

Is it possible to set up an OU, move a group in to the OU, and have a linked GPO apply to all the users that are a member of that group, but the users are in a different OU?

If it matters, this is Windows Server 2003.

share|improve this question

No it isn't, but you can link the GPO to the OU where the user accounts are and filter the GPO for those users in the group, meaning the GPO will only apply to the users in the OU that are members of the group. This is a fairly common practice.

share|improve this answer
Or, if the users are not all in the same OU, you can link the GPO to the domain root and do the same; it will still get applied only to users which are members of that group. – Massimo May 15 '12 at 12:25
Ok, that should work, what is the terminology I am looking for to read up on this, group filtering or ? – Scott Szretter May 15 '12 at 12:33
It's called "Security Filtering" and can be seen in the lower panel in the right-hand pane of the GPMC when viewing the Scope tab of a GPO in the GPMC. – joeqwerty May 15 '12 at 12:37

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.