OU's and GPO vs. WMI Filtering

[Guest]

We're trying to finalize an OU design and we have one group of people suggesting that instead of making a separate OU for laptops that we should instead only have one OU for all machines and then manage GPO application on laptops with WMI filtering. I'm worried that this contravenes the purpose of AD/OU's/GPO's and that instead of managing by policy we will end up managing by exception
If I'm right, can anyone point me to any documentation of best practices or product intent to support my case? I have found very little on WMI filtering

thanks

 

[Derek Melber [MVP]]

Len,

I can't point you to a document at this second that specifically states that
you should design OUs to apply GPOs, but I don't know too many AD gurus, GPO
gurus, or MVPs that would suggest otherwise. The use of Security Filtering
and WMI filtering is only designed for those rare instances, where OUs can
handle the job.

--
Derek Melber

We're trying to finalize an OU design and we have one group of people

suggesting that instead of making a separate OU for laptops that we should
instead only have one OU for all machines and then manage GPO application on
laptops with WMI filtering. I'm worried that this contravenes the purpose
of AD/OU's/GPO's and that instead of managing by policy we will end up
managing by exception.

If I'm right, can anyone point me to any documentation of best practices

or product intent to support my case? I have found very little on WMI
filtering.