What objects in an OU inherit Group Policies?

[KJ]

Can you add users to a group and then groups to an OU to
inherit whatever policies have been configured? I found
this article which says:

"In order to apply Group Polices to specific users or
computers, you add users (or groups) and computers to
container objects. Anything in the container object will
then get the policies linked to that container. Sites,
Domains and OUs are considered container objects."
http://www.svrops.com/svrops/documents/gpolicies.htm

I am trying to configure a login script at the OU level
but it will not run. Inside the OU are two nested OUs.
Beneath the nested OUs are global groups which contain
users. The only way the login script will run is if I
take the users out of the group and stick them directly
inside the OU. This does not make sense to me. If you
have 2000 users does that mean you have to stick them all
into an OU for the GPO to apply? Doesn't this defeat the
herarchy structure?

 

[Ulf B. Simon-Weidner]

Can you add users to a group and then groups to an OU to
inherit whatever policies have been configured? I found
this article which says:

"In order to apply Group Polices to specific users or
computers, you add users (or groups) and computers to
container objects. Anything in the container object will
then get the policies linked to that container. Sites,
Domains and OUs are considered container objects."
http://www.svrops.com/svrops/documents/gpolicies.htm

I am trying to configure a login script at the OU level
but it will not run. Inside the OU are two nested OUs.
Beneath the nested OUs are global groups which contain
users. The only way the login script will run is if I
take the users out of the group and stick them directly
inside the OU. This does not make sense to me. If you
have 2000 users does that mean you have to stick them all
into an OU for the GPO to apply? Doesn't this defeat the
herarchy structure?

Hello KJ,

the behavior is correct and expected. Group Policies are only applied to users
and computers traversing the hierarchy of OUs from the Object. If you need to
apply GPOs to a Group you have to define the Policy at a level wich is parent
of all users, and use the Access Control List (Security Tab, Read and Apply
Policy) to adjust the rights as needed. Now the users of the group will get the
policy, while others won't.

Gruesse - Sincerely,

Ulf B. Simon-Weidner

 

[Cary Shultz [A.D. MVP]]

Vielen Dank, Ulf.

Cary

Hello KJ,

the behavior is correct and expected. Group Policies are only applied to users
and computers traversing the hierarchy of OUs from the Object. If you need to
apply GPOs to a Group you have to define the Policy at a level wich is parent
of all users, and use the Access Control List (Security Tab, Read and Apply
Policy) to adjust the rights as needed. Now the users of the group will get the
policy, while others won't.

Gruesse - Sincerely,

Ulf B. Simon-Weidner