I'm currently trying to design the OU and Group design for a new AD deployment. Firstly, taxonomy is hard. As a first guess attempt, we're trying to keep all User objects together in
OU=Users, and some sub-OU beneath that.
We've got a bunch of Team and Subteam OUs, and some Toolset OUs, which group by what functional teams people are in, and also by what tools they need access to.
We'd like to keep users in the Users OU, and each Team OU contains a Security Group object, which we can add Users to when they join teams, or need toolset access.
Here's how the AD is laid out:
Domain Root | | \--OU=Users | | | \--OU=Staff | | \-Username=Tom.OConnor, MemberOf=RedTeam | | | \--OU=Contractors | | | \--OU=Visitors | | \--OU=Teams | | | \--OU=RedTeam | | \-GroupName=RedTeam | | | \--OU=BlueTeam | | \-GroupName=BlueTeam | | | | | \--OU=GreenTeam | | \-GroupName=GreenTeam | | | \--OU=Toolsets | | | \--OU=DevTools | | \-GroupName=DevTool_CITool | | | | | \--OU=InternetAccess | | \-GroupName=InternetAccess
Tom.OConnor is in Group RedTeam.
A GPO is applied to
The GPO Results wizard shows that this GPO has not been applied to the
Conversely, a GPO applied to
OU=Staff,OU=Users is applied to the
So is it possible to apply a GPO to an OU, containing a Group, and have the GPO subsequently trickle down, and be applied to all members of the Group?