Applying GPO via Security Groups

Question

I am new to GPO. I would like to apply a policy to specific machines in different OUs and am wondering how to do this. For example.

Machine 1,2,3 are in (security) group 1 (M1,M2,M3,G1)
Machine 4,5,6 are in (security) group 2 (M4,M5,M6,G2)
Odd machines need GPO1 applied to them and even machines need GPO2

I thought if I were to put odd/even machines in different security groups (G1,G2) I would be able to designate the GPO that should apply via Security Filtering. However, this is not the case.

How can/should I approach this issue?

Answer 1

Computers need to be rebooted to pick up the group membership, or you can use klist -lh 0 -li 0x3e7 purge on the computers to refresh the kerberos tickets and the group memberships.

Also, this would only be applicable for Computer policies. User polices would require enabling User Group Policy Loopback Processing.

For testing purposes, you should also confirm if adding the computer(s) directly to the Scope filtering to confirm if that works. If it does not, the issue is not related to the group memberships.

Answer 2

Don't forget to remove "Autenticated Users" from the security filtering, because all your users AND computers are in "Autenticated Users".

If you don't remove "Authenticated Users", even if you add your groups in the security filtering, they will not filter anything at all...