Windows Forum

Ask something
Discussion Locked

Active Directory GPO issues

0 helpful
2 replies

by taz1nl

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hi,

I'm trying to deploy a piece of UPS software on all my servers, but first I have 2 questions.

1. In our AD OU setup we have servers in seperate OU's as shown below:

Domain Root
|
|
Domain Controllers
|
|
server gpo
|
|_Exchange Servers
|
|_File Servers

How do I organize this structure so I can publish the software to all servers without having to actually move the server computer objects around from the above OU's? The reason I ask this is because ie Domain Controllers computer objects need to stay in that OU as they have critical policies assigned to them (as do the exchange/file servers). So if they are moved to a new OU that I ie create for software deployment purposes they will no longer get the policies from their original OU's. Should I create a sub-OU within this structure, and if so how?

2. I routinely have to deploy software via gpo. Do I really need to create a new GPO for every single piece of software I want to deploy, as this way I would end up with literally hundreds of GPO's and the whole structure would look rather messy! Can I somehow create one master GPO for all my software deployment needs, or would that be impractical?

3. While doing a test deployment I tried to publish the above software to one of the servers only and on the security filtering I just added the domain user account. But when I login to the server with this account I do not see the published software in add/remove programs where it should be. What's going wrong there? I tested it on my own xp pc and it worked fine. Is there a different procedure for publishing software on servers??

Any help will be appreciated as this is urgent.

Thanks,
Taher

2 replies

by bfilmfan

You can create a GPO and link it to any OU you wish.

To link a GPO to a domain or an organizational unit, click Start , point to Programs , point to Administrative Tools , and then click Active Directory Users and Computers .

Alternatively, to link a GPO to a site, click Start , point to Programs , point to Administrative Tools , and then click Active Directory Sites and Services .

Right-click the site, the domain, or the organizational unit to which the GPO should be linked.

Click Properties , and then click the Group Policy tab.

To add the GPO to the Group Policy object Links list, click Add .

Click the All tab, click the GPO that you want to add, click OK , and then click OK .

NOTE : You link a GPO to specify that its settings apply to users and computers in the site, the domain, or the organizational unit, and to users and computers in Active Directory containers that inherit data from the site, the domain, or the organizational unit.

by bfilmfan

And based on personal experience, using GPO's to push software is just a really bad idea.

Microsoft removed portions of code from both GPO and DFS to prevent technical people from using it like SMS.

This discussion is closed to new replies.