software deployment issue

Group Policy Objects only apply to local systems, sites, domains and OU's. You cannot apply it directly to a security group. You can filter a security group from applying the GPO however.

Your GPO is functioning exactly as it should, which is a good thing since you daid it did apply to objects in that OU.

If you want to apply that GPO to other computers in other OU's, then you should reverse your thinking. Apply the GPO, but remove the ability to read and apply the GPO to the groups which you do not want it applied to.

As Bfilm says, the GPO is being applied correctly to the OU, you just didn't add the computers you wanted to have the software available to the OU in which the GPO applies. Just add in the computers you want to that OU and the program will be available.

I'm not sure if my issue was correctly understood. What I'm trying to do is deploy software to computers spread across OU's in AD, as apposed to just one single OU which would be easy as the GP would apply to the computers in that OU. But since I have to drag computer accounts in a particular OU for deployment, this would mean that the computer account would no longer receive any GP's that were linked to it. For example, I have a SUS GPO that is linked to my Computers OU and if I remove the computer account from the Computers OU to another OU for software deployment purposes then that PC will no longer receive critical MS updates. See what I mean?

Furthermore, I recently read the following comment in a Windows Server 2003 book:

"Since computer accounts tend to be organized by where they are located or who uses them for what, you may find winxp workstations all over the place in AD Users and Computers. So what can you do, except pick and choose machines individually? The answer is to put them into groups. Computers have accounts, accounts can be added to groups, and groups aren't affected by the boundariesof something as simple as an OU. I know, I know, GP's aren't applied to groups, they are applied to containers like OU's. Apply the policy to the domain, then go to the security tab and uncheck the Apply Group Policy check box for all groups but the computer group for your choice."

So the above text suggests you CAN do what I was trying to do, but for some reason it's not working for me. Or maybe I'm interpreting this all wrong? I'm not entirely sure what the last sentence means, as I've added the pc accounts to a group and in gpmc security filtering only that group is included and on the security tab that group has read and apply GP rights. Could someone please clarify this for me in plain English.

Thanks in advance,
Taz

Ah, ok. Group Policy is applied in an order. local , site, domain, and OU as Bfilm pointed out. Further, there are to methods of appling GP. Computers and Users. There are also 2 methods to software deployment, with options available to you . Published and Assigned. If you have a software program you want to make available to ALL users within your domain but you don't want to have to install the damn thing, you can make it available in add/remove programs. To accomplish this, you assign or publish the program to a "user". To make the GPO applicable across the domain the GPO is linked at the domain level. To make it available to select users, you can assign the program to the user or assign it to the computer they use.

Note: Normally, OU structure is planned either in a functional method, geographical method or a mixed functional/geographic method. OUs are planned to group users and computers into a functional department structure which mimics departments physical layout. That way you apply the GPO for software deployment, to the uppermost OU in the functional department structure so that all within the department receives the program in ADD/Remove programs in the control panel if needed and you reduce the administrative burden of complex GPO structure.