I set up some GPOs and linked them to the top-level domain in the forest. They had security filtering enabled so that they would apply to a particular group, and everything worked great.

My GPO tree was getting a bit messy so I created a single OU right under Default Domain Policy for these users that need the GPOs. I deleted the previous links and made new ones inside the new OU. But when I run modeling for a test user for a test machine, none of these GPOs are applying anymore.

What changed? Why do the GPOs no longer apply? I thought OUs were not supposed to have any bearing on anything but helping with organization.


  • What did you move into this new OU? Users? Computers? Both? What does the GPO apply policy for? Computers? Users? Both? – MDMarra Feb 8 '13 at 20:01
  • Cool, thanks for leading me in the right direction-- I didn't realize I had to go back to AD Users and Computers and actually move objects into the OU that magically appeared there. I thought that was what security groups were for. – johnny Feb 8 '13 at 20:08
  • No, GPO doesn't apply to security groups. You can use it to filter not not to apply. Security groups for for things like share permissions and other things like that. I'll post this as an answer. Feel free to click the green check next to my answer below to accept it as correct. – MDMarra Feb 8 '13 at 20:15

Judging by your comments, you moved a group into this new OU and not the users or computers that you want the policy to apply to. This isn't how GPO works. GPO applies to user and computer objects. You need to actually have those objects in the linked OUs for them to apply.

Security groups can be used to further filter who GPOs get applied to using security filtering, but GPOs are not applied to groups ever.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.