Re: Applying GPO only to certain computers within an OU...........

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance

Perhaps there is some complication in your situation that I don't know
about, but here's my suggestion.

I suggest avoiding the complexity of attempting to manage the application of
GPOs via security and groups. Create a new OU as a child of the existing
OU, apply the Software distribution policy to that sub-OU and move the
computers you want to have that GPO applied to into the new sub-OU. Any
GPOs applied to the parent OU will be inherited by the new sub-OU, so the
moved computers will still get those GPOs applied to them.

One of the big features of Active Directory is the flexibililty to move
things around and change the OU hierarchy easily; take advantage of that to
avoid the need to use more complex features such as security filtering.

--
Bruce Sanderson MVP

It's perfectly useless to know the right answer to the wrong question.


"Momo" <louey-3@xxxxxxxxxx> wrote in message
news:1112867143.894012.63330@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
> We are in the process of deploying some software via GPO to computers
> within an OU. The problem is we don't want to apply the software to all
> machines within the OU.
>
> So far what we've successfully done is create a Group and add computers
> which we don't want the policy to apply. And then in the GPO secuiryt
> properties deny them group from reading and applying the policy. This
> has successfully worked.
>
> But what we would rather is reverse and have computers which we wnat to
> apply the policy in the group. What we tried is by default deny the
> "Authenticated Users" group from applying the policy giving them read
> on. Then for the group give them read and apply. But this hasn't worked
> successfully........
>
> Has anyone tried something like this or have any suggestions....please
>


.

Relevant Pages

  • Re: Group Policy
    ... but somehow that policy doesn't take effect on those computers although ... I set the policy setting to "DISABLED" for the policy named "Password must ... meet complexity requirements". ... In a domain -- there can be only one password (account) policy and this ...
    (microsoft.public.windows.server.security)
  • Re: Reinstall everytime assigned applications through GPO on start
    ... Software installation extension has been called for background policy refresh ... Stations - R&D Software (EMEA computers). ... Stations - R&D Software (EMEA computers) is set for installation because it ... The assignment of application Remote Administrator v2.1 from policy Software ...
    (microsoft.public.windows.group_policy)
  • Re: Reasons and examples for security
    ... Roger Abell ... >> "Use passphrases" (with some details tbd relative to retraints ... >> on length minimum and relationship with complexity policy). ...
    (microsoft.public.security)
  • Re: Universal grammar
    ... I just "saw" the complexity of a task, ... eastern hemisphere. ... at as a prodigy in plane recognition, ... I see a future in hybrid computers: ...
    (sci.lang)
  • OO and information oriented programming (was Re: Simple Parser)
    ... >> If you're developing a compiler for a language for the first time, ... >> the grammar you're using does what you want, ... Computers don't just process for the sake of it. ... reducing complexity, a task at the core of software development. ...
    (comp.programming)