1

I'm currently trying to design the OU and Group design for a new AD deployment. Firstly, taxonomy is hard. As a first guess attempt, we're trying to keep all User objects together in OU=Users, and some sub-OU beneath that.

We've got a bunch of Team and Subteam OUs, and some Toolset OUs, which group by what functional teams people are in, and also by what tools they need access to.

We'd like to keep users in the Users OU, and each Team OU contains a Security Group object, which we can add Users to when they join teams, or need toolset access.

Here's how the AD is laid out:

Domain Root
|
|
\--OU=Users
|   |
|   \--OU=Staff
|   |   \-Username=Tom.OConnor, MemberOf=RedTeam
|   |
|   \--OU=Contractors
|   |
|   \--OU=Visitors
|
|
\--OU=Teams
|   |
|   \--OU=RedTeam
|   |   \-GroupName=RedTeam
|   |
|   \--OU=BlueTeam
|   |   \-GroupName=BlueTeam
|   |
|   |
|   \--OU=GreenTeam
|   |   \-GroupName=GreenTeam
|
|
|
\--OU=Toolsets
|   |
|   \--OU=DevTools
|   |   \-GroupName=DevTool_CITool
|   |
|   |
|   \--OU=InternetAccess
|   |   \-GroupName=InternetAccess

User Tom.OConnor is in Group RedTeam.

A GPO is applied to OU=RedTeam,OU=Teams.

The GPO Results wizard shows that this GPO has not been applied to the Tom.OConnor user.

Conversely, a GPO applied to OU=Staff,OU=Users is applied to the Tom.OConnor user.

So is it possible to apply a GPO to an OU, containing a Group, and have the GPO subsequently trickle down, and be applied to all members of the Group?

4
  • It occurs to me that you're using an OU structure that doesn't really do anything for you. Most people set up their OUs in a per-site or per-department hierarchy. Since GPOs don't apply to group objects, there's very little or no benefit to splitting them out like this. More typically, you'd just put your user objects under the appropriate OU (Red Team/Blue Team/Green Team), and then, in addition to the security filtering option, you could control who gets what GPOs by which OU you link them under. Feb 19, 2014 at 12:37
  • As I think I said, it was a first guess attempt. Feb 19, 2014 at 12:41
  • Yup... just hoping that my comment on a more common structure will lead to a better second attempt or implementation. Feb 19, 2014 at 15:08
  • Yeah. Totally scrapping this implementation. It's a shame you can't apply to groups and let it filter down, though.. Feb 19, 2014 at 15:26

1 Answer 1

6

GPOs only apply to user objects and computer objects.

You will need to apply the GPO to the Users OU, and use security group filtering to ensure it only applies to the users of the RedTeam group.

4
  • That sucks. Way to go Microsoft. Making everything far more complex than it needs to be. Feb 19, 2014 at 11:37
  • 3
    Perhaps, but things could get extraordinarily complex if GPOs were assigned to objects within groups. In many cases, it could lead to a single ou with a single group in it, just for the purpose of applying policy. How would inheritance work, if you had two competing GPO settings applied to different group objects containing the same users? The structure of an AD could get quite unwieldy. Security filtering is very powerful and gives you the control you are after. The model you are proposing would make sense for the scenario you described, but it would make life incredibly hard in others. Feb 19, 2014 at 11:45
  • @TomO'Connor you can use security filtering here. Link it at high level and use the group in question in place of "Authenticated Users"
    – MDMarra
    Feb 19, 2014 at 12:30
  • +1 - Security Group Filtering is exactly what you're asking for re: "applying a GPO to a group" and having it "filter down". It's a really, really common thing to do. Feb 19, 2014 at 17:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .