1

OU.png

hey guys,

im trying to applying the following GPO

Computer Configuration > Preferences > Windows Settings > Shortcuts

Action : Update

Target Type : File System Object

Location : All Users desktop

in the COMMON tab i check item level targeting and choose new security group and choose \GROUP1 and GROUP2

the policy is applied to OU1 … group1 exists in OU4 and group2 exists in OU5

in the security filtering i remove the authenticated users delegation ( i keep the READ access )

and add GROUP1 and GROUP2

what am i doing wrong ? can anyone help please

5 Spice ups
2

If you are trying to apply computer settings via GPO and filtered out “authenticated users” you are basically excluding computers as well. Add “Domain Computers” to security filtering section. Gpupdate and reboot the clients

4 Spice ups
3

Not sure what you are trying to do exactly but Computer Configuration is for Computers, not Users. Adding the Users into a Security Group may not work.

Are the required Computers in the OU you are assigning the GPO to?

2 Spice ups
(oumolayna) 4

i did not add any user into any security group … there are no users here … everything is applied to computers … the OUs contains COMPUTERS … and group1 and group2 contains COMPUTERS of different classes

1 Spice up
5

Ah I see. I have to confess I have never added Computers into a Security Group.

6

More info on that:

1 Spice up
7

What ou do the computers themselves exist in? The gpo needs to be applied to the ou that contain the computers as this is a computer policy. Being that you are using preferences to select the computers to apply this to you really don’t need to do anything with security filtering as it will only apply to the computers that belong to the groups in question.

Make sure to reboot the computers to force their group memberships to update after running gpupdate /force from an elevated console.

Make sure that under item level targeting you selected the OR operator as it defaults to an And. You could also just target ous and not bother with groups unless their are computers in those ous that do not need the gpo applied.

1 Spice up
8

Alright thanks guys… Off for the weekend now… I’ll read the article and try few stuff and let u know the outcome

9

GPOs don’t apply to groups.

It does not matter where the groups are located in your domain.

You can filter GPOs with groups however the GPO must be linked to the OU containing the computer objects that you want the GPO to apply to.

I am not exactly sure what you are trying to accomplish. I am guessing that the shortcut you are trying to place is not showing up?

I am not sure why you are doing security filtering and targeting. Usually one or the other is fine. Typically ILT is preferred as it is and can be more specific. Make sure if you have multiple lines in ILT that you are choosing correctly between OR/AND. If you use AND you will have to be a member of both groups you are filtering by vs OR where you can be a member of either and get the policy.

If you can post the shortcut you are trying to apply it may be an issue with what you are trying to apply. Keep in mind, don’t use quotes in the target box or trailing slashes.

Is there anything in Event viewer as to why the GPO is not working correctly?

Does (make sure to run as admin)

GPResult /r /scope:computer

show it as being applied to the machine in question?

1 Spice up
10

this was very helpful actually thank you …

1 Spice up
11

the reason is that i want to create different shortcuts for different computers … so i do not want to apply the same group policy multiple times to every OU … this method im using working perfectly fine for me to groups of USERS … this is the first time im trying to apply it to a group of COMPUTERS …

12

actually the policy is working fine … i already tried to gpresult /r and it shows the GPO is applied successfully… i tried RSOP and there no errors … i tried to access that shortcut via \servername\shortcut and i can access it just fine …

im gonna try a few more stuff … if it doesnt work … im gona have to apply the same policy multiple times to different OUs …which i do not prefer but i ll have to

13

I’m not sure I understand your question then. So what doesn’t work? The GPO will only apply to OUs that are in its linked scope.

You can link the GPO to the top Computers OU and apply individual shortcuts based on groups with ILT.

Unless you are blocking inheritance it will apply to any sub OU.

3 Spice ups
14

ok … this is where im at now

I Applied the GPO to OU1 and removed " Apply this policy " from Authenticated Users … i added GROUP1 in the scope then i went to item level targeting and added that group … and this worked … ( note : the computers exists in OU4 and OU5 )

so now i want to add GROUP2 , i add group2 to the scope and i go to item level targeting and add a new item security group … add group2 and magically it stops working at all … the GPO stops working on either group1 and group2

i guess its something like you said JUSTIN1250 … something with the AND/OR

how do i change it to OR … by default when i add two groups in item level targeting i get AND

15

ok i changed the " AND " to " OR " and it worked and honestly i wouldve never thought of this … so thank you so much … this is very in depth GPO hehehe … thank you guys

1 Spice up