Is there a way to apply a group policy by subnet?

I have three sites/offices - Washington, Texas, and California. When we (IT) puts a new desktop on the network and add it to the domain, the computer object gets dumped in the generic/default OU of "COMPUTERS" where I have to manually move the new system into their respective container by location.

Is there a way to have, at time of adding a system to the domain, to have Group Policy be applied to move the computer object into their local site OU?

I'm thinking that by subnet might be easiest, but I'm not deadset on it. Any advice would be appreciated.

  • 1
    Can a Group Policy setting move the computer to the appropriate OU when the computer is joined to the domain? No. – joeqwerty Jul 12 '18 at 20:15
  • Damn. Thanx for the response. – David Jul 12 '18 at 20:49

The short answer to your question is yes. Group policy can be linked to an AD site. If the subnets and sites are correctly configured in ADSS, the policies will apply to the site. You can then apply further policies against OUs. To your other question around moving the computer to the right OU, this can easily be done through a script and deploy it to the sites.

| improve this answer | |
  • I'd like to add, that if you are imaging the machine from a common image, a startup script can be executed to move the system as appropriate. It will be a bit ... involved. But it can be done. – Joseph Kern Jul 14 '18 at 13:44
  • The crux of the question is "Can a Group Policy setting move a computer to an OU" and the answer is: No. – joeqwerty Jul 14 '18 at 13:53
  • not sure i see the requirement to do it through a GP "setting" in the question. can you move a computer OU by applying a GPO? i didn't test but i don't see why a script deployed through a GPO wouldn't do run and move the computer. – baservepla Jul 15 '18 at 1:49

The optimal solution is to create the computer object before it is domain-joined. It's called pre-staging. Second best would be a schedule task to move the computer based on IP address or name.

| improve this answer | |
  • So for the first option, I think what you're saying is to "seed" the computer object first? That would work but I was hoping to make this process a little more automated. My overall goal is to do less with AD than I need to and this is one way I can reduce the amount of IT involvement. I'll look into how this process can work to make things efficient but at the same time keep looking for a way to improve the process. Thanx for the advice. – David Jul 17 '18 at 17:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.