I have an request to apply computer policy changes to a specific set of users. For example, I want a specific windows feature (Allow Cortana) available to members of a security group (CortanaUsers).
My first internet search showed me examples of how to set up an OU and attach a group policy object that only applied to that OU to enabled Computer policies. I discovered that computers needed to be manually added to the OU (as adding a group of computers did not expose the policy via a pushed update or users running gpupdate on those computers). This solution was not well received because a computer can only exist in on OU at a time.
Subsequently I found advice to add a security group with computers to the root OU, and have the policy applied last. This too was not well received because it required upfront knowledge of which computers the users would be using.
Finally it was recommended to me to have a log-on script execute (with local admin permission) that modified computer policy settings by seeing if the logged in user had membership in a security group. That way the feature would be enabled or disabled based on who logged in with what computer. I am not an expert at how roaming profiles or such scripts work.
I want to be able to apply computer policies for a security group of users. What is the best way to do that?