We have a small (>100 machines) Windows domain running Server 2008R2. We use Symantec Endpoint Protection 12.1 I want to have GPO deploy the AV software to client machines automatically, but only to client workstations, not to servers, which run a different software.

I've set it up before using a GPO linked to the domain mycompany.local and it works, but it deploys the AV software to ALL machines on the domain, including my servers. I can create an OU in active directory for Servers, and perhaps create one for client machines too, but I'd rather not have to go and move new domain members from the default under Computers into a different folder.

How can I use GPO to deploy this AV software only to workstations on our network, and not to servers?


Objects in the default Computerscontainer in AD don't get group policies applied, aside from policies applied at the domain level. So, in order to apply the Software install to ONLY workstations, you should create another OU for workstations and move all workstation into it. You would then apply your Software install policy on that Workstation OU.

| improve this answer | |

That is where WMI filters are your friend. Create the following WMI filter and link it to the GPO:

select * from Win32_OperatingSystem where ProductType = "1"

Win32_OperatingSystem class

| improve this answer | |

As Cheekaleak stated you can create an OU for the workstations, move the computer objects for the workstations to this OU, and link your AV GPO to this OU.

If you'd rather not move the workstation computer objects out of the default Computers container (which really is not that big of a deal) then you can use Security or WMI filtering on the AV GPO (linked to the domain) to have it apply only to the workstations.

| improve this answer | |
  • Or jeremy could use redircomp.exe to redirect his default computer objects container (technet.microsoft.com/en-us/library/cc770619(v=ws.10).aspx) – matrixx333 Mar 19 '12 at 17:46
  • That's not a solution. It does nothing for existing computer accounts... AND... it redirects ALL newly created computer accounts... leaving him in the same situation of having ALL computer objects (workstations and servers) in the same OU. GPO filtering at the domain level or having an OU for ONLY the workstations are the two solutions I see for this. – joeqwerty Mar 19 '12 at 17:59
  • My comment was misinterpreted. I apologize, I should have been more detailed in my explanation. I meant for him to create a new "Workstations" OU, move the existing computer objects to the new OU, then use redircomp to redirect any "new" computer objects to the "Workstations" OU so that he would not have to do it manually in the future. – matrixx333 Mar 19 '12 at 18:03
  • 1
    matrixx333: I see what you're saying but this would also affect new computer accounts for servers as well as workstations, so the OP would still have to manually move computer accounts, in this case for servers. – joeqwerty Mar 20 '12 at 2:07
  • Ahhh.....Servers! I didn't take that into consideration. Good point! – matrixx333 Mar 20 '12 at 10:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.