3

I know I can set up an OU, move user objects in to it, and link a GPO to that OU and that GPO will apply to those users.

Is it possible to set up an OU, move a group in to the OU, and have a linked GPO apply to all the users that are a member of that group, but the users are in a different OU?

If it matters, this is Windows Server 2003.

1 Answer 1

6

No it isn't, but you can link the GPO to the OU where the user accounts are and filter the GPO for those users in the group, meaning the GPO will only apply to the users in the OU that are members of the group. This is a fairly common practice.

3
  • 2
    Or, if the users are not all in the same OU, you can link the GPO to the domain root and do the same; it will still get applied only to users which are members of that group.
    – Massimo
    May 15, 2012 at 12:25
  • Ok, that should work, what is the terminology I am looking for to read up on this, group filtering or ? May 15, 2012 at 12:33
  • It's called "Security Filtering" and can be seen in the lower panel in the right-hand pane of the GPMC when viewing the Scope tab of a GPO in the GPMC.
    – joeqwerty
    May 15, 2012 at 12:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .