I'm experimenting with using OUs in my network's Active Directory and group policy. However, I'm having a little trouble figuring out the right way to structure my OUs so that I can have individual departments, but also have a higher level management users gain all rights of the departments lower on the organization's hierarchy.

Let's say I have 4 organizational units

  • Sales
  • Marketing
  • Accounting
  • Executive

Each department has their own drive mapping, which I set up through individual group policies within the department OUs. However, the one exception to this structure is the Executive department. These are the leaders of the company, so I would like users in this OU to get access to ALL of the drive mappings, not just a single drive. However, since an OU can only have one parent, I don't know how I could set this up so that the Executive OU can inherit the drive mapping policies from all departments.

One thought would be have individual policies for each drive mapping, and then simply link the drive mapping policies to each department I wanted to have access. In this case, the Executive OU would have 4 links, one for each drive mapping. While this makes sense to a certain extent, it doesn't sound like the most maintainable solution. Everytime a department was added, or if additional policies were granted to an existing department, I would need to duplicate this link in the Executive OU as well.

The other thought I had would be to simply use Security Groups as the objects in each OU, and assign departmental users to the security group instead of the OU (e.g DOMAIN\Marketing). However, this does not appear to work the way I expect. Group policies only seem to be applied to a user once they have been added to the appropriate OU, and it does not matter what Security Group they are in.

The only other solution I can think of is to simply move the department policies out of OUs and instead rely on Security Filtering to apply the policies to different Groups. However, this does not seem to be the way that most examples and tutorials handle managing their policy objects, instead favoring these departmental OUs like I've listed above.

What is the proper way for me to structure my Group Policy objects to accomplish what I am after?


The proper way of handling this is using a single group policy for drive maps across your organization, with the usage of Group Policy Preferences.

You can then set up targeting rules on each drive map according to your own security scheme. I'd probably avoid using OU's as the targeting rule, since you would need security groups no matter what.

  • Thanks, that will work great. I'm still left without a good understanding of when OUs should be used, but clearly they're not a good fit for my drive mapping scenario. – mclark1129 Apr 27 '14 at 1:31
  • @MikeC Think of them as folders. OUs in Active Directory are much like folders in a file system. – HopelessN00b Apr 29 '14 at 21:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.