Applying group policy only to members of a domain local securitygroup

So there is domain ABC.local with various OUs and sub-OUs defined.
There is also domain local security group (placed in ABC\Users)
defined whose members are users from various OUs/subOus. If I wanted
to apply group policy only to that securiy group, how would I do that?

I tried to link group policy object at the ABC.local domain level and
then apply security filtering by removing Authenticated users group
and adding domain local security group containing users from various
OUs.
However the policy did not apply to the users. When I linked group
policy object to OUs where users reside, it got applied. How is this
explained?

Regards,
Drazen

Hello Drazen,

A GPO can only be applied to users or computers, NOT to security groups.
You can use security filtering only if the user accounts/computer accounts
are in the OU where you apply the security filtering.

See also:
http://technet.microsoft.com/en-us/l...88(WS.10).aspx

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


> So there is domain ABC.local with various OUs and sub-OUs defined.
> There is also domain local security group (placed in ABC\Users)
> defined whose members are users from various OUs/subOus. If I wanted
> to apply group policy only to that securiy group, how would I do that?
>
> I tried to link group policy object at the ABC.local domain level and
> then apply security filtering by removing Authenticated users group
> and adding domain local security group containing users from various
> OUs.
> However the policy did not apply to the users. When I linked group
> policy object to OUs where users reside, it got applied. How is this
> explained?
> Regards,
> Drazen

Thanks Meinolf, that clears it.

Regards,
Drazen

On Mar 6, 11:46*pm, Meinolf Weber [MVP-DS] <meiweb@(nospam)gmx.de>
wrote:
> Hello Drazen,
>
> A GPO can only be applied to users or computers, NOT to security groups.
> You can use security filtering only if the user accounts/computer accounts
> are in the OU where you apply the security filtering.
>
> See also:http://technet.microsoft.com/en-us/l...88(WS.10).aspx
>
> Best regards
>
> Meinolf Weber
> Disclaimer: This posting is provided "AS IS" with no warranties, and confers
> no rights.
> ** Please do NOT email, only reply to Newsgroups
> ** HELP us help YOU!!!http://www.blakjak.demon.co.uk/mul_crss.htm
>
> > So there is domain ABC.local with various OUs and sub-OUs defined.
> > There is also domain local security group (placed in ABC\Users)
> > defined whose members are users from various OUs/subOus. If I wanted
> > to apply group policy only to that securiy group, how would I do that?
>
> > I tried to link group policy object at the ABC.local domain level and
> > then apply security filtering by removing Authenticated users group
> > and adding domain local security group containing users from various
> > OUs.
> > However the policy did not apply to the users. When I linked group
> > policy object to OUs where users reside, it got applied. How is this
> > explained?
> > Regards,
> > Drazen

Hello Drazen,

You're welcome.

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


> Thanks Meinolf, that clears it.
>
> Regards,
> Drazen
> On Mar 6, 11:46 pm, Meinolf Weber [MVP-DS] <meiweb@(nospam)gmx.de>
> wrote:
>
>> Hello Drazen,
>>
>> A GPO can only be applied to users or computers, NOT to security
>> groups. You can use security filtering only if the user
>> accounts/computer accounts are in the OU where you apply the security
>> filtering.
>>
>> See
>> also:http://technet.microsoft.com/en-us/l...88(WS.10).aspx
>>
>> Best regards
>>
>> Meinolf Weber
>> Disclaimer: This posting is provided "AS IS" with no warranties, and
>> confers
>> no rights.
>> ** Please do NOT email, only reply to Newsgroups
>> ** HELP us help YOU!!!http://www.blakjak.demon.co.uk/mul_crss.htm
>>> So there is domain ABC.local with various OUs and sub-OUs defined.
>>> There is also domain local security group (placed in ABC\Users)
>>> defined whose members are users from various OUs/subOus. If I wanted
>>> to apply group policy only to that securiy group, how would I do
>>> that?
>>>
>>> I tried to link group policy object at the ABC.local domain level
>>> and
>>> then apply security filtering by removing Authenticated users group
>>> and adding domain local security group containing users from various
>>> OUs.
>>> However the policy did not apply to the users. When I linked group
>>> policy object to OUs where users reside, it got applied. How is this
>>> explained?
>>> Regards,
>>> Drazen