1

Hi, i have configured a new policy to apply some settings both to user and computer configuration.

I need to apply this GPO only to “some” computers, not all. For that reason i’ve created a security group with all users that needs the policy.

When i add the group to the security filter, the policy applied only to user level and all computer configurations doesn’t take effects.

In delegation tab i have added “Domain Computers” group in “read” permission and the policy it’s been linked to both user and computers OU.

How can i apply the policy to that users and their computers? Thank you!

4 Spice ups
2

Is their computer a variable? Do that get a different computer every time?

3

How many DCs do you have ? Can you confirm that the GPO is propagated to all the DCs ?

4

Yes, i can confirm the GPO is propagated to all DCs even because if i manually add a computer hostname inside the Security Filter, the policy works (computer settings and user settings).

The computers could be variable and this is why we want to have a “group” to apply the policy and not the specific computernames.

To be more clear: if i apply the policy to “USER GROUP”, i want the policy to be applied to the users that are part of the group and their computers.

5

You don’t apply Group Policy to groups. Group policy is applied to a User Object (Typically HKCU) or a Machine object (Typically HKLM)

Computer Configurations are per machine. You can’t turn them on and off per user. If the machines are part of that group the policy will apply, if they are not they won’t.

Depending on the settings you want there may be other ways to achieve your goal

6

Hi Justin, thank you for your answer (and also to other users above, of course).
The policy contains different OneDrive settings located in “Computer Configuration\Administrative Templates\OneDrive”.

I understand my problem could be related to the fact that my “USER GROUP” (let’s call it like this) is a user object group. So, how can i set the policy to be applied to this user group and the related machines?

When using “Auhenticated user” in the security filter i have the policy applied for both object type (users and machines). How can i do the same for a part of it?

Sorry guys, i’m new to this world so thank you for your support!

7

You can’t filter a Computer Configuration per User. Computer GPO objects are applied to the machine object. It is like a light switch for the machine. The setting is either on or off.

Authenticated Users is a special Identity. It includes pretty much anything that authenticates, this includes computer objects, which is why the GPO would apply when you are using this group in security filtering.

8

I do this same kind of security filtering for a GPO that targets our handful of laptop users with docks.

Simply add the machines as well as users into that security group and you’ll be good to go. Do make sure it’s above all user/computer objects hierarchy wise in your domain.

9

Thank you for the idea but if a single user change the computer or have more than one computer, the policy needs to be manually update with the new computername. This is why i’m looking for a solution to automatically apply the Computer Configuration settings to all computers (present and future) for that user.

10

What you want to do is not possible as far as I can imagine. Computer Configs ONLY apply to computers, no matter the user; User Configs apply only to users, no matter what machine they’re on. If you could set the policy that you currently have set in Computer Config and instead set it under User Config, that would do exactly what you want.

Then just set up what I mentioned before, just add specific users to the Security Filtering of the GPO or add a security group containing all the needed users.