1

I have a group policy that I have created allowed certain users the right to shut down. this is a computer setting and will apply to the computers in the OU it is linked to.

My question is what if I have a group in the OU that has the GPO linked. That group contains the server computer that I want the GPO to apply to. I don’t want to move the actual computer object into this OU. I would rather have a group that has that computer object as a member. Is this possible?

4 Spice ups
2

You would add the group into security filtering.

1 Spice up
3

GPO’s only apply to user or computer objects not security groups Windows Administration: Your Guide to Group Policy Troubleshooting | Microsoft Learn

2 Spice ups
4

so even though the OU that is linked with the GPO has a group with USERS AND COMPUTERS as members of the group, the GPO will not apply.

Basically it has to have the actual objects in the OU and not just a group with them being members???

1 Spice up
5

From the link above:

GPOs Don’t Apply to Groups.

Although you may wish it were so, a GPO cannot apply to an Active Directory security group object. The only two objects that a GPO setting can configure are computers and users. GPOs can’t configure objects via group membership.

1 Spice up
6

You can apply a GPO to more than one OU though. So you could apply this GPO to the OU that the server is in.

7

Here’s a good webinar from Pluralsight I watched the other week. It covers most of the main Group Policy targeting concepts if you’re interested: https://www.youtube.com/watch?v=39UzbF5UPzU

1 Spice up
8

In the GPO, if you make a setting in the User Policy section then that policy should be linked to the OU that contains the users.
If you make a Computer Policy setting, then you will need that linked to the OU containing the Computer Object. If you want it to apply to everyone and all devices then you can link it at the root of the domain and it will get everything at once without you having to move anything.