I'm having a bit of a hard time understanding the scope of GPOs, links, and security filters.
From what I understand, then LINK establishes to whom the GPO may apply to and that the security filter sets who it actually does apply to (with the limitation of only being able to apply the GPO to objects that fall underneath what is linked to it). Please correct me if I'm wrong.
So my situation is, I've recently installed WSUS. Under my domain I created an OU for Computers, then OUs within it for each department, and then the actual computer objects go within each of those department OUs respectively.
Ideally, I'd love to edit my GPO, go to the Security Filtering and say "Apply this to GPO to all the computers in the Finance, Marketing, and Sales OUs". Unfortunately, the Security Filter only works with Users, Groups, and Computers... not OUs (meaning I'd have to either create groups for each OU or select computers individually, neither of which I want to do).
So now that I've departmentalized my computers into OUs, how can I most efficiently apply the WSUS GPO to the computers in the Finance, Marketing, and Sales OUs?