General discussion

Locked

Group Policy Object administration

By UncleRob ·
I am new to group policy and it's use.
Configuring group policy seems simple enough but I do have questions concerning it's application. I have a win2k3 domain controller and editing/creating policies by using the AD Users & Computers console.

I have created an outlook 2003 gpo.
I want to apply it to users in the domain.
It's possible that not all users require this specific outlook 2003 policy.

Do I apply the gpo at the domain level? (in doing so that would apply the gpo to every user in the domain) Is it best practice to apply most gpo's at the top domain level if the changes are meant for every user or is it a better practice to apply gpo's to specific ou's or the objects within those ou's?

I have several OU's setup for different site locations (ex. Chicago, New York, Los Angeles, etc.)
Do I apply gpo's at the OU level or do I apply it to the objects within each OU, example the "users" or the "computers" groups within each OU.

Does anyone know or can anyone explain the logic for determining which objects to apply the specific group policy against.

In my example, I'm trying to determine if I should apply an outlook 2003 policy to the OU itself or to the users group or computers group within that OU.

Do software policies typically get applied against the users group or the computers group?
What would be the difference? Doe it even matter?

Take into account I'm a bit of noob when it comes to group policy administration but I'm learning quickly and would really appreciate a discussion on this subject with users who have experience in this area.

Thank You for your consideration!

This conversation is currently closed to new comments.

3 total posts (Page 1 of 1)  
| Thread display: Collapse - | Expand +

All Comments

Collapse -

GPO

by The Listed 'G MAN' In reply to Group Policy Object admin ...

You can apply GPO's to OU's & specific users & groups. For example you could put an OU at the top level but only allow it to effect department A. Only those people in security group department A would pick up the settings.

Collapse -

hey...

by UncleRob In reply to GPO

I got a response, awesome!

I have a handle on that part of it.

I'm actually trying to determine what the difference is if I apply the policy to the users group within a site OU or the computers group within a site OU. Is there an advantage/difference between the 2? Since my policy is software specific (outlook 2003) what would be the difference in applying the policy to the users group or the computers group within a specific OU?

Collapse -

Well you don't

by The Listed 'G MAN' In reply to hey...

get that choice.

GPO has to be on an OU, after which you select who within or below (via any groups) get the settings.

Users get User Settings
Computers...Well Computers
Outlook would be user settings.

Back to Desktop Forum
3 total posts (Page 1 of 1)  

Hardware Forums