1

Is it possible to assign a GPO to only computers within an OU without having any group listed in security filtering? I have a policy that contains both user and computer configurations with loopback enabled and I need it to apply to to a OU group containing computers only. I’ve specified a security group containing the computers but its not applying on the computer as it says in GPRESULT, access denied (Security Filtering) even though it’s in the group to get the policy

5 Spice ups
2

I guess the question is can I have the policies under an OU an have nothing listed in Security Filtering as the default group is Authorised Users. Can I remove this and just apply to the OU it’s linked to?

3

No.

It wont apply if there is nothing in the filter there.

Authenticated Users is generally a good idea to use unless you dont want it.

It is a general term for authenticated user logons as well as computer logons, so it works with Computer GPOs.

4

Security filtering works based on Groups/object accounts, not OUs. Links determine OU application.

If you have loopback turned on anything you have in the user configuration will apply to all users who log in to that set of machines. You are getting an error because of the security filtering plus the loopback. For the security filtering to work with loopback both the user and the computer must have the apply delegation. If you have this policy linked to an OU of only machine objects it will only apply the user configurations to these machines when a user logs into these machines specifically. It will not apply the user configurations anywhere else so long as the policy is not linked to an OU of users.

5

So the policy can stay as it is but what do I need in security Filtering then, Authenticated Users? Because this is a test policy and not live I wanted it to apply to only the computers in the AD group which is why I added the group into the Filtering

6

You need to make a test OU for testing GPOs

1 Spice up
7

Making test OU’s is not really something we do which is why I had to make a test policy and apply it to only my test pcs, how do I successfully accomplish this without making a test OU

8

Would this do it… if I have the policy under the OU of all machines and then in the AD group have the test machines, then link this AD group into the security filtering alongside Domain Users for the policy. That should only apply the policy to all users on those test machines, not the live ones…?
In the live deployment I’d just have the policy in the OU and have security filtering set to Authenticated Users so every user gets it on all those machines in the OU but it’s not suitable for testing that’s the only reason I have to do it this way

9

erm.jpg

You … test new GPOs in your production environment? How do you still have a job?

3 Spice ups
10

We’re a hospital so we don’t go around changing OU structure as a rule that’s why I have to find alternative ways around an otherwise simple solution, I know creating a test OU would just solve everything but we can’t do it like that

11

Well, I would really push whoever is in charge to let you use a test OU as this is the safest course of action. Cause you never know, I mean you are taking advice from random people on the internet about a production environment and well it is a hospital.

However to answer your question yes. If you want a GPO with loopback to apply you will need a group with both the computer objects you want as well as the user objects you want. Without them both loopback policies will be denied.

2 Spice ups
12

You do have a point and I suppose I am taking answers off random people but I also have common sense and knowledge in Group Policy so I know what your suggestions will do to the environment, I’m only asking to get other suggestions to see if there’s better ways of doing things. But on another note thanks for answering the question at least I know that’ll be the most viable solution for testing

13

No offense (like that really means something), but that is the silliest thing I have ever heard. I have worked with plenty of Dr’s offices and hospitals. Those are the places where you most definitely need a test environment before pushing something out.

1 Spice up