troubleshooting Question

How to design OUs and GPOs with multiple objectives in mind?

Avatar of hypercube
hypercubeFlag for United States of America asked on
Active Directory* gp1
4 Comments1 Solution77 ViewsLast Modified:
I just read https://activedirectorypro.com/group-policy-best-practices/ and thought it contained a pretty good idea.
Rather than using Deny, it encourages that "GPO1" be applied at the OU root level and then creates a sub-OU for which a contradicting "GPO2" is applied (directly).

But, after thinking about it, one realizes that things can only be a set of unique objects in each OU.
So then, what if one has another treatment to apply via "GPO3" to a set of objects that overlaps the membership of "GPO2" above?
Then the method falls apart.

I've often wondered about this and am looking for some logical structure that would allow:
GPO1 applied to a,b,c,d,e,f,g
GPO2 applied to f,g
GPO3 applies to e,f,g,h
There is an intersection between all 3 GPOs: f,g
There is an intersection between GPO1 and GPO3: e,f,g
GPO3 has a member (h) that is not in the other two GPOs.

In my cases, so far, I find that there would be a GPO to apply to all Users or all Computers with some exceptions in each case.
So, creating OUs for the exceptions as suggested, may likely not work.
There only needs to be yet one more GPO with a different set of excepted objects and with overlap, but not 100%  overlap, of those objects.

The referenced note above suggests one way when one OU is part of a root (or higher level) OU.  But that seems to barely scratch the surface.
What is the best way to tackle this rather obvious situation/objective in designing GPOs, OUs, etc?
ASKER CERTIFIED SOLUTION
Adam Brown
Cloud Security Consultant
Join our community to see this answer!
Unlock 1 Answer and 4 Comments.
Start Free Trial
Learn from the best

Network and collaborate with thousands of CTOs, CISOs, and IT Pros rooting for you and your success.

Andrew Hancock - VMware vExpert
See if this solution works for you by signing up for a 7 day free trial.
Unlock 1 Answer and 4 Comments.
Try for 7 days

”The time we save is the biggest benefit of E-E to our team. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange.

-Mike Kapnisakis, Warner Bros