Re: GPO Computer Setting - Ccan they be applied to Users ?

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance

From: Herb Martin (news_at_LearnQuick.com)
Date: 11/20/04 

Date: Sat, 20 Nov 2004 16:37:13 -0600

"Charles" <Charles@discussions.microsoft.com> wrote in message
news:9D3E4F73-4AD6-4EC1-8B7E-63001347AE96@microsoft.com...
> We've implemeted GPOs in our environment OK - but have one fundamental
> issue. Our AD design is structured by department - so we have for example
an
> HR OU, an IT OU, a FINANCE OU etc. These OUs contain user objects. We have
> not got an OU for computers - the computer objects all reside in a default
> container - i understand i can move these object to an OU. This leads on
to
> my question - can the computer configuration part of a gpo be applied to
user
> objects

No. The Computer part will not affect the Users directly.
(It will apply to their computers and may change what they can
do of course.)

> ( or rather to OUs that contain user objects - I'm guessing NO - I've

You may be confusing LINK with APPLY. All GPOs contain both a
Computer SECTION and a User SECTION. Either can be empty, or
even disabled, or they both may contain active settings.

The Computer portion is applied only to computers and the User portion
is applied only to Users in any case.

You can put you Computers in the same OU as the Users or you can put
them in either completely separate or perhaps some child/sibling OU
from the Users.

> configured a gpo with computer and user settings and applied it to an OU
that
> contains user objects - only the user configuration gets applied.

Only the User section applies to users and only the Computer section
applies to Computers. (Both sections always exsist, even if disabled.)

> Am I right
> in saying I'll need to configure OUs to put my computer objects in and
apply
> a GPO that contains the computer configuration settings -

Probably. If you need computer settings then you need to put the Computers
in an OU (either a new or existing OU) or you may apply those settings to
the
Domain as a whole if you don't wish to put the computers in an actual OU.

> I was trying to avoid this.

Why?

There is probably no reason for avoiding this step. It is usually
the "right thing" to do, in fact.

The SAME GPO can have settings for both Users and Computers and
each section will affect only that type of objects. People do this every
day.

It is the way it was designed to work. 

-- 
Herb Martin
> Thanks
> Charles

Relevant Pages

  • Re: Aftermath of RDIRCMP.EXE?
    ... Why not just make the Default Domain Policy back to default, which wiill eliminate any possibility that anything you change in there will affect the domain adversely. ... Then create the OU, and as Jorge suggested, link the GPO you previously created, or if you haven't created one, create one with the necessary settings. ... Also, just an FYI, there was another thread recently posted with a similar question, including an OU/GPO design question. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Loopback processing, roaming profiles, folder redirection for domain-member laptops
    ... I suggest not mixing Computer Settings and User Settings in the same GPO - this restricts your flexibility and can be confusing ... if you put the laptops' user accounts into a seperate OU from the desktops, then you can use loopback processing to apply different User Configuration settings to the laptops and desktops if you also seperate out the settings you want to be different into seperate GPOs ... User Configuration, Network, Offline Files, "Do not automatically make redirected folders available offline" prevents that from happening BEFORE redirecting any folders - its not retro active. ...
    (microsoft.public.windows.group_policy)
  • Re: AD OU Objects and Replication Performance
    ... > to plan an OU design in such a way that you effectively ... > use settings applied by GPO ... > settings. ... >>organizing folder. ...
    (microsoft.public.win2000.active_directory)
  • Re: Loopback processing, roaming profiles, folder redirection for domain-member laptops
    ... I suggest not mixing Computer Settings and User ... Settings in the same GPO - this restricts your flexibility and can be ... Configuration settings to the laptops and desktops if you also ... User Configuration, Network, Offline Files, "Do not ...
    (microsoft.public.windows.group_policy)
  • Re: Getting desperate: GPO applying incorrectly, PLEASE HELP ME!!
    ... User and Computer settings a single GPO,. ... OU with the Terminal Server computer accounts, ... See in particular the section called "Group Policy Loopback ...
    (microsoft.public.windows.group_policy)