Can I apply a 'User' Group policy preference by User OU and select an 'Is Not' for Computer OU
Posted on 2011-10-12
We are trying to take advantage of Group Policy Preferences to target specific people or computers in the business using 'Item Level Targeting'. On the most part this works brilliantly, but one specific situation doesn't seem to work and I'd like to both know that it should work, and if it should how do we do it! I imagine something simple is being missed or it fundamentally doesn't allow this to work.
I have created a GPO with the shortcuts I want creating in the 'Startup' folder. I have used the User Configuration\Preferences\Windows Settings\Shortcuts section to create the shortcut. I want the members in the team to log on to any PC in their team's computer OU and get the shortcut. This is easy, as I just apply the GPO to the User OU and it works. But, there are standalone PC's in the department that do not need the shortcuts copying to the 'Startup' folder on login, so I created an OU in the computers OU for the department called 'Standalone' and added 'Is Not' statements against the Standalone OU specifying Computers as the target.
All in all, this means if the user logs in the GPO is targeted at the User based on their OU. The shortcut group policy preference item is under the User section of the GPO. The targeting (supposedly) allows the shortcut to be created, unless the Computer is in the 'Standalone' OU. Well, this is how it should work.
In reality, the shortcut gets created no matter which PC they log onto, so this isn't working. Is this because item level targeting for User items applied to User OUs won't count Computers as targeting criteria? We would like to do similar things with printers based on where users sit based on the computer so I'd like to know if it's possible and how to achieve it.