1

I have an OU that has only computer objects. I want to apply a GPO to only ONE of the computer objects. The rest of the computer objects in the OU will not get the GPO applied.

What are the best ways to accomplish this without having to move the computer objects out of the OU?

Thanks everyone!

10 Spice ups
2

You could do item level targeting, but the quickest and easiest way will be to add an OU within this one (a nested OU), put that one computer in the nested OU and then link the GPO to that nested OU.

8 Spice ups
3

You can also edit the “Security Filtering” under “Scope.” By default, all GPOs apply to all “authenticated users,” which in the case of computers, means all domain member computers. On the GPO in question, remove “authenticated users,” then add the computer you want the GPO to apply to (you’ll have to add “Computers” to the object types searched int the dialog window when doing so). The GPO will then only apply to that computer (assuming that computer is in the OU to which the GPO is applied) and no others.

4 Spice ups
4

Use “Security Filtering”. But first, add that computer account to a group. “Security Filtering” work with groups.

3 Spice ups
5

Since this is only a one-off deal, if the policies you want applied to this single computer don’t conflict with other inherited policies, you could just use a script/registry to apply these settings instead of creating a whole OU/GPO for a single machine.

That also depends on what it is you’re trying to set.

Otherwise, just do item level targeting.

6

Security filtering works with users, security groups (Global only), or computers.

But security groups are preferred according to best practices.

–

My preference for the OP’s scenario would also be to use Security Filtering; its kinda what it was designed for. An extra OU is kinda overkill - the way I manage AD, anyway. If using a group, the computer would have to be restarted after having been added to the group to ensure it gets its new group membership.

3 Spice ups