I'm having a bit of a hard time understanding the scope of GPOs, links, and security filters.

From what I understand, then LINK establishes to whom the GPO may apply to and that the security filter sets who it actually does apply to (with the limitation of only being able to apply the GPO to objects that fall underneath what is linked to it). Please correct me if I'm wrong.

So my situation is, I've recently installed WSUS. Under my domain I created an OU for Computers, then OUs within it for each department, and then the actual computer objects go within each of those department OUs respectively.

Ideally, I'd love to edit my GPO, go to the Security Filtering and say "Apply this to GPO to all the computers in the Finance, Marketing, and Sales OUs". Unfortunately, the Security Filter only works with Users, Groups, and Computers... not OUs (meaning I'd have to either create groups for each OU or select computers individually, neither of which I want to do).

So now that I've departmentalized my computers into OUs, how can I most efficiently apply the WSUS GPO to the computers in the Finance, Marketing, and Sales OUs?

1 Answer 1


The default security filter for a GPO is to apply to the group Authenticated Users; this includes all users and computers in the domain.

Set the security filter back to containing Authenticated Users, then link the GPO to the desired OUs (and make sure it's not linked anywhere that you don't want it).

  • Ok, So the Filter being set to Authenticated Users allows anyone, but the LINK sets the scope of that? So if my Finance OU has 5 computers in it and I link the GPO only to that OU and then set the Filter to Authenticated Users, it will apply the GPO to those 5 computers only?
    – Safado
    Apr 14, 2011 at 14:50
  • 1
    @Ryan Correct. The way to think about it is "All GPOs linked to parent OUs of an object will apply, with GPOs closer to the object taking precedence (except when a higher one is in "enforce" mode), as long as the object is in the GPO's security filter". Apr 14, 2011 at 15:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .