1

Hi guys,

Question on Group Policies.

Scenario is like this. I have a Parent OU with about 6 Child OU’s under it. I have maybe 6 or so Policies linked to Parent OU. However, I dont want one of the Child OU’s to inherent one of the Policies.

I dont want to Block Inheritance because that would block all policies.

How do I get around this?

Thanks in advance.

8 Spice ups
2

As far as I know you don’t, I have similar situations where I’ve had to block inheritance and manually link the policies I want to apply

3

I’m assuming you want to selectively block inheritance rather than block this OU from inheriting any GPOs. If you want to block evrything you can right click on the OU and select ‘Block Inheritance’

Assuming you want to selectively block GPOs - you can’t directly, but you can create multiple links to a single GPO within the schema - so your instances of GPOs that need to be blocked by one of the child OUs, are not linked to the parent OU at all, but rather linked to the relevant child OUs themselves that require it and not linked to the one that doesn’t. This isn’t particularly elegant but it is relatively transparent

This becomes a mess if there are too many instances of it occuring, but when you’re talking 5 or 6 - it’s probably the easiest way I’d do it, as it still immediately makes sense to anyone else looking at it, and to you when you come back to it 2 years later

1 Spice up
4

Move the OU to the same level as the parent and then link only the ones you need

5

Blocking inheritance then re-linking the policies you need would be the correct way to go IMO

6

Wonder if item level targeting would help in this instance.

1 Spice up
7

I’m with Sam on this one. Just link the GPO to each individual child OU you want it to apply to instead of the parent OU

8

Sorry for late response guys.

I went with Sam on this and just linked the GPO to each individual OU.

Thanks guys.