Applying GPO to a Group Containing Computer Objects

andrewhaverland7281 · 2015-01-16T16:46:19.000Z

I have created several groups to which I have added several computer objects. Then I created a GPO to apply computer settings using the previously created groups. After forcing a gpupdate on the computers and running a Group Policy Results, none of the computers received the GPO/settings. When I first started testing, all the computer objects were contained in the default computers folders and the group containing the computer objects was in the OU to which the new GPO was applied. As I continued to test the new GPO, I moved the computer objects to the same OU that the new GPO was applied with the group of computer object applied to the GPO. Even after moving the computer objects and forcing gpupdate, the new GPO was not applied. Finally, I added the specific computer objects in the new GPO instead of the group of computer objects. Once I forced a gpupdate, the results showed that the new GPO was applied to the computer objects. What I would like to know, is there a way to use a group of computer objects to apply computer settings with a GPO? I do not want to have to add each individual computer object to a GPO.

sandeepnagar · 2015-01-16T17:00:12.000Z

assign policy on the top as parent and deligation accordingly…

andrewhaverland7281 · 2015-01-16T17:17:02.000Z

Unfortunately that didn’t work.

shuey · 2015-01-16T17:46:17.000Z

I don’t know if I’m confused about what you’re trying to do, or if you’re confused about how GPOs work (maybe a little bit of both, lol). In a nutshell, you should be able to put your computers in an OU, then link a GPO to it - done.

As far as “not having to add each individual computer object to a GPO”, maybe you’re thinking in terms of “Security Filtering”? As long as your GPO has a security filtering status of “Authenticated Users”, that will apply to USERS AND COMPUTERS.

If I’m way off, I’m gonna need to get a better understanding of how you currently have things setup, and what you’re trying to accomplish :-/…

danielsalzedo · 2015-01-17T00:17:31.000Z

GPO’s can only be applied to User and Computer objects, not groups or other AD objects. However you can achieve what you want by using Security Filtering and/or WMI filtering to apply the GPO to a sub-set of your user or computer objects.

In your case where you want to apply the GPO to computers who are already a member of a group you have created you need to do the following:

Apply the GPO at the closest level of your domain that will contain all the computer objects themselves that are in your group. IE If your computers are all in Domain.local/OU#1/OU#2 you can apply the GPO to just OU#2. However if you have the Computer objects in both OU#1 and OU#2 you have to apply the GPO to OU#1 and allow inheritance on OU#2 (This is on by default). Alternatively if you have a complex set of OU’s and the Computer objects in question are scattered all over it you will have to apply the GPO at the root of the domain. (This is less efficient processing-wise in a large domain so be careful with it.)
Create the Security Filter using the group that contains the computer objects you have already created. Note that if the purpose of the group is to seperate computer accounts by their properties that can be read via WMI (E.G. The version of Windows) you can use a WMI filter and not have to bother manually maintaining the group at all.

HTH

Daniel

anil-lepide · 2015-01-19T06:20:36.000Z

Group Policy applies to the user or computer in a manner that depends on where both the user and the computer objects are located in Active Directory. However, in some cases, users may need policy applied to them based on the location of the computer object alone. You can use the Group Policy loop-back feature to apply Group Policy Objects (GPOs) that depend only on which computer the user logs on to. Please refer to this KB to gather information in depth : Loopback processing of Group Policy - Windows Server | Microsoft Learn

Little-Green-Man · 2015-01-23T02:11:49.000Z

This might help. The reason I think the policy didn’t happy is because you need to reboot to apply computer settings. These settings are applied at boot up. User settings are the only ones you can force without a log off log on. Try that if you haven’t and report back.

andrewhaverland7281 · 2015-01-26T14:47:19.000Z

It looks like I might have it working. I have to run a few tests and I will report back with what I found out.

jamesm2 · 2017-02-18T23:09:42.000Z

Basically, it could be better! GPO could be vastly improved and is cumbersome to use. Microsoft have got he knack for making what should be easy, more difficult. They just like things that way and think people live behind a computer. The fact is, I tried to do a similar thing and had to resort to WMI which is definitely not ideal. I have gone from site to another and I think I have read so many times, people saying you just link it to an OU. You can, but I think people are missing the point. If you have an OU called servers and wish to target the server OU only - WITHOUT actually selecting any server, It can not be done! You have to choose servers from the list. That’s being dynamic out the window as far as I am concerned unless you choose to use WMI which is not ideal.I think this is what the majority of people are missing when they say “just link it to an OU”. No, it is not that simple. It never is with Microsoft.Moreover, you can not simply create a policy and apply it to an existing OU in AD DS, like a Servers OU that already exists. That would be far to easy Microsoft but this is the way it should work. Instead, you have to create your own OU in GPMC. Please public, correct me if I am wrong with anything I am saying here. Sometimes I can just hit my head on a brick wall when it comes to my brain trying to think the way Microsoft does. I think MS must have a bunch of developers that smoke pot all day long. They certainly do not like to make things easy for us.

I am also uncertain about this comment " GPO cannot be applied to groups or other AD objects. I am sure you can apply a policy to a group and you can also select computer names in an OU.

psophos · 2017-02-19T00:10:41.000Z

You’ve opened a 2 year old question with a rant. One that I’m struggling to make much sense of. You’d be better off asking a new question as most people will see the [solved] part or the age and just ignore it.

Something to note. When you have a nice fresh install of AD, most of the “folders” are Containers (CN) and not Organisational Units (OUs). About the only one that is an OU is ‘Domain Controllers’.

So you cannot link a new GPO to most of the existing structures in AD. You can link them at the Domain level or to the Domain Controllers OU.

You are encouraged to create an OU structure for your own company that suits your GPO needs. Perhaps something like this under the Domain.

Domain
    Corp_Name
        Computers
            Servers
            Workstations
            Laptops
        Users
            HR
            IT
            Admin
            ...

Then you get to chose what GPOs to create and where to link them.

lowellneuenschwander · 2017-03-09T17:45:53.000Z

ahaverland,

Curious if you did get it to work and what method you used?