1

I need to apply a GPO that contains user settings, on a specific subset of computers. (Fixing some invalid user\printer settings). The users are in their own OU, as are the computers. The policy should apply to any user login to that group of computers.

The only way I have been able to get this to run correctly (in testing) was to link the GPO in the User OU, and then use WMI filtering to target specific computers. I have some questions that I did not understand while testing, hoping someone can clarify:

  1. I attempted to use security filtering, setting authenticated users to read, and the computer object to apply; but the policy did not load, is there a reason why?
  2. Is WMI filtering my only option here?
  3. Is it possible to WMI filter by OU membership?
  4. If not, would creating a security group and attaching all the computers be the easiest route (most performant?)
1 Spice up
2

Why do you need to restrict the policy to only a subset of devices, if the settings are user based, do you not want those settings to follow the users?

3

You want to apply the user GPO to the computers OU but then you need to enable loopback processing. Administrative Templates, select System, select Group Policy, and then enable the option Configure user Group Policy loopback processing mode.

2 Spice ups