Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm currently trying to design the OU and Group design for a new AD deployment. Firstly, taxonomy is hard. As a first guess attempt, we're trying to keep all User objects together in OU=Users, and some sub-OU beneath that.

We've got a bunch of Team and Subteam OUs, and some Toolset OUs, which group by what functional teams people are in, and also by what tools they need access to.

We'd like to keep users in the Users OU, and each Team OU contains a Security Group object, which we can add Users to when they join teams, or need toolset access.

Here's how the AD is laid out:

Domain Root
|   |
|   \--OU=Staff
|   |   \-Username=Tom.OConnor, MemberOf=RedTeam
|   |
|   \--OU=Contractors
|   |
|   \--OU=Visitors
|   |
|   \--OU=RedTeam
|   |   \-GroupName=RedTeam
|   |
|   \--OU=BlueTeam
|   |   \-GroupName=BlueTeam
|   |
|   |
|   \--OU=GreenTeam
|   |   \-GroupName=GreenTeam
|   |
|   \--OU=DevTools
|   |   \-GroupName=DevTool_CITool
|   |
|   |
|   \--OU=InternetAccess
|   |   \-GroupName=InternetAccess

User Tom.OConnor is in Group RedTeam.

A GPO is applied to OU=RedTeam,OU=Teams.

The GPO Results wizard shows that this GPO has not been applied to the Tom.OConnor user.

Conversely, a GPO applied to OU=Staff,OU=Users is applied to the Tom.OConnor user.

So is it possible to apply a GPO to an OU, containing a Group, and have the GPO subsequently trickle down, and be applied to all members of the Group?

share|improve this question
It occurs to me that you're using an OU structure that doesn't really do anything for you. Most people set up their OUs in a per-site or per-department hierarchy. Since GPOs don't apply to group objects, there's very little or no benefit to splitting them out like this. More typically, you'd just put your user objects under the appropriate OU (Red Team/Blue Team/Green Team), and then, in addition to the security filtering option, you could control who gets what GPOs by which OU you link them under. – HopelessN00b Feb 19 '14 at 12:37
As I think I said, it was a first guess attempt. – Tom O'Connor Feb 19 '14 at 12:41
Yup... just hoping that my comment on a more common structure will lead to a better second attempt or implementation. – HopelessN00b Feb 19 '14 at 15:08
Yeah. Totally scrapping this implementation. It's a shame you can't apply to groups and let it filter down, though.. – Tom O'Connor Feb 19 '14 at 15:26
up vote 6 down vote accepted

GPOs only apply to user objects and computer objects.

You will need to apply the GPO to the Users OU, and use security group filtering to ensure it only applies to the users of the RedTeam group.

share|improve this answer
That sucks. Way to go Microsoft. Making everything far more complex than it needs to be. – Tom O'Connor Feb 19 '14 at 11:37
Perhaps, but things could get extraordinarily complex if GPOs were assigned to objects within groups. In many cases, it could lead to a single ou with a single group in it, just for the purpose of applying policy. How would inheritance work, if you had two competing GPO settings applied to different group objects containing the same users? The structure of an AD could get quite unwieldy. Security filtering is very powerful and gives you the control you are after. The model you are proposing would make sense for the scenario you described, but it would make life incredibly hard in others. – elrich00 Feb 19 '14 at 11:45
@TomO'Connor you can use security filtering here. Link it at high level and use the group in question in place of "Authenticated Users" – MDMarra Feb 19 '14 at 12:30
+1 - Security Group Filtering is exactly what you're asking for re: "applying a GPO to a group" and having it "filter down". It's a really, really common thing to do. – Evan Anderson Feb 19 '14 at 17:13

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.