Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I know I can set up an OU, move user objects in to it, and link a GPO to that OU and that GPO will apply to those users.

Is it possible to set up an OU, move a group in to the OU, and have a linked GPO apply to all the users that are a member of that group, but the users are in a different OU?

If it matters, this is Windows Server 2003.

share|improve this question

1 Answer 1

No it isn't, but you can link the GPO to the OU where the user accounts are and filter the GPO for those users in the group, meaning the GPO will only apply to the users in the OU that are members of the group. This is a fairly common practice.

share|improve this answer
2  
Or, if the users are not all in the same OU, you can link the GPO to the domain root and do the same; it will still get applied only to users which are members of that group. –  Massimo May 15 '12 at 12:25
    
Ok, that should work, what is the terminology I am looking for to read up on this, group filtering or ? –  Scott Szretter May 15 '12 at 12:33
    
It's called "Security Filtering" and can be seen in the lower panel in the right-hand pane of the GPMC when viewing the Scope tab of a GPO in the GPMC. –  joeqwerty May 15 '12 at 12:37

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.