Applying GPO at the Domain level

[spiceuser-p5xos]

We are trying to implement security hardening for over 3,000 client workstations across our Active Directory infrastructure by deploying a Group Policy Object (GPO) at the domain level within the computer configuration. In specific server Organizational Units (OUs), we plan to use overriding policies to disable this security hardening for Servers.

I’m seeking advice on potential drawbacks or risks associated with this approach. Your insights on this matter would be greatly appreciated.

[tghowe]

I just set the ‘Block Inheritance’ check on the server OUs and create separate server policies.

[spiceuser-p5xos]

@tghowe We are planning to enforce this workstation security hardening GPO policy, and it appears that blocking inheritance won’t work this context, given our current approach.

[pkrupicka]

You can use Security filtering and/or WMI filter . You can also apply the GPO to workstation OUs only.

[matt7863 (m@ttshaw)]

Applying at the top level has risks - it will try to apply to all computers unless a block is in place, and if that fails it will apply.

Good practice would be to apply at the top level of one or more OUs that require the settings. Applying policies that filter out also causes start-up/logon delays as the policy has to be processed.

[tghowe]

WMI Filtering was going to be my next response and is easy to apply.