GPO Security Filter: if two, is it AND or OR? (Must have 'Authenticated Users'?)

I'm a total newbie to active directory, so I'm sorry if this is a really dumb question, but I'm trying to push out FLASH 12.0.77.  I'm doing it as a MACHINE based software install of the MSI.

It's linked to everyone at my location.

I want to first test it with my "FLASH-TEST-GROUP" (which I put in the security filtering section).

a) In addition to my "flash-test-group", do I also need "authenticated users"?

b) If there are two items in the security filtering section, does it act as an AND or an OR??

Thanks,
Mike
mike2401Asked:
Who is Participating?
 
oBdACommented:
Let's start with b): Just like NTFS ACLs, Security Filtering for GPOs is additive, or, as you put it, an "OR" relation. If an object is in any one of the groups in the Security Filtering field (and the object is in or under the OU to which the GPO is linked), the GPO will apply to this object.
So for a), if you leave "Authenticated Users", you don't need to bother with "flash-test-group", because "Authenticated Users" is already basically every domain member (computers included). In other words: remove "Authenticated Users" from the list if you only want to test it with "flash-test-group".
0
 
Joseph DalyCommented:
A) You actually would not want the authenticated users in there as it would negate your Flash-test-group setting. Think of the security filtering the same way you think of NTFS security. If a user is a member of two groups the permissions get combined to the highest level.

B) See above.
0
 
mike2401Author Commented:
Thank you both, that makes total sense !!!
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.