Are there other ways in Active Directory to organize computer objects for Group Policy application besides OU?

How could one apply a policy only to certain computers in many disparate OUs? I'm looking for something akin to the Collections metaphor within SCCM, where a computer can belong to many groups.


The way I do it is to Put the GPO as far down the directory structure so that it covers all of the OU's that you want it to effect. Then you can setup filter based on Security group or WMI queries.

If you aren't using Group Policy Management Console, i suggest you go grab it from Microsoft, it will make your life easier and you can set the filtering options via it's interface.


WMI Filters are your friend.



You could attach the OU to a high enough OU to cover all the computers, and then assign it to a group of computers rather than a group of users. The computers pick up their machine settings at startup (and other times depending on your refresh settings).


An additional option is to link the GPO to multiple OU's; however, Zypher's answer is the best option if you don't want the policy to apply to all computers in an OU.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.