I'm experimenting with using OUs in my network's Active Directory and group policy. However, I'm having a little trouble figuring out the right way to structure my OUs so that I can have individual departments, but also have a higher level management users gain all rights of the departments lower on the organization's hierarchy.
Let's say I have 4 organizational units
Each department has their own drive mapping, which I set up through individual group policies within the department OUs. However, the one exception to this structure is the Executive department. These are the leaders of the company, so I would like users in this OU to get access to ALL of the drive mappings, not just a single drive. However, since an OU can only have one parent, I don't know how I could set this up so that the Executive OU can inherit the drive mapping policies from all departments.
One thought would be have individual policies for each drive mapping, and then simply link the drive mapping policies to each department I wanted to have access. In this case, the Executive OU would have 4 links, one for each drive mapping. While this makes sense to a certain extent, it doesn't sound like the most maintainable solution. Everytime a department was added, or if additional policies were granted to an existing department, I would need to duplicate this link in the Executive OU as well.
The other thought I had would be to simply use Security Groups as the objects in each OU, and assign departmental users to the security group instead of the OU (e.g DOMAIN\Marketing). However, this does not appear to work the way I expect. Group policies only seem to be applied to a user once they have been added to the appropriate OU, and it does not matter what Security Group they are in.
The only other solution I can think of is to simply move the department policies out of OUs and instead rely on Security Filtering to apply the policies to different Groups. However, this does not seem to be the way that most examples and tutorials handle managing their policy objects, instead favoring these departmental OUs like I've listed above.
What is the proper way for me to structure my Group Policy objects to accomplish what I am after?