GPO-preferences not applies to a group in OU, only to users

1. gpo created using user configuration\ prefernces \control panel \ scheduled tasks

2. applied ou containing users , group

3. group contains users in current ou , users different ous.

4. gpo applies users in ou applied not users members of group residing in other ou.

resultant gpo not shows gpo neither in applied nor denied users in different ous.

why?

---

--- when hit wrong note next note makes or bad. --- miles davis

1. gpo created using user configuration\ prefernces \control panel \ scheduled tasks

2. applied ou containing users , group

3. group contains users in current ou , users different ous.

4. gpo applies users in ou applied not users members of group residing in other ou.

resultant gpo not shows gpo neither in applied nor denied users in different ous.

why?

because that's not how gpo works.

gpo linked ou (or ad site, or, domain root), , gpo processed computer objects (or user objects).

if gpo contains computer settings, computer objects process , apply gpo. group not computer.

you *can* use gp security filtering filter computer objects within ou (or not) apply gpo, gpo not traverse/recurse/apply via group objects (i.e. members of group) in example, because computer objects in ou apply gp.

[this 1 of primary reasons designing ad ou structure based around how gp needs applied. structure ad ous logical groupings of users/computers allow linking of gpos without having create complex filters, and exploit inheritance logic]

if have several different ous containing computers, , each of ous requires common settings applied, consider linking single gpo multiple ous. if there computers in ou need settings , there computers in ou should not have settings, have several choices implementation, here few;

a) create ou (perhaps child ou of first ou) move computers child ou , link gpo there (this leverages inheritance feature)

b) leave computers in single ou apply security filtering gpo gpo applies those. (create ad group, add computers new group, , use ad group security filtering gpo read+apply permission, , remove default permission authenticated users)

c) create ou (not child of first ou) , link needed gpos new ou, , move computers new ou

---

don
(please take moment "vote helpful" and/or "mark answer", applicable.
helps community, keeps forums tidy, , recognises useful contributions. thanks!)

Windows Server  >  Group Policy