We help IT Professionals succeed at work.

How to design OUs and GPOs with multiple objectives in mind?

I just read https://activedirectorypro.com/group-policy-best-practices/ and thought it contained a pretty good idea.
Rather than using Deny, it encourages that "GPO1" be applied at the OU root level and then creates a sub-OU for which a contradicting "GPO2" is applied (directly).

But, after thinking about it, one realizes that things can only be a set of unique objects in each OU.
So then, what if one has another treatment to apply via "GPO3" to a set of objects that overlaps the membership of "GPO2" above?
Then the method falls apart.

I've often wondered about this and am looking for some logical structure that would allow:
GPO1 applied to a,b,c,d,e,f,g
GPO2 applied to f,g
GPO3 applies to e,f,g,h
There is an intersection between all 3 GPOs: f,g
There is an intersection between GPO1 and GPO3: e,f,g
GPO3 has a member (h) that is not in the other two GPOs.

In my cases, so far, I find that there would be a GPO to apply to all Users or all Computers with some exceptions in each case.
So, creating OUs for the exceptions as suggested, may likely not work.
There only needs to be yet one more GPO with a different set of excepted objects and with overlap, but not 100%  overlap, of those objects.

The referenced note above suggests one way when one OU is part of a root (or higher level) OU.  But that seems to barely scratch the surface.
What is the best way to tackle this rather obvious situation/objective in designing GPOs, OUs, etc?
Comment
Watch Question

Adam BrownSenior Systems Admin
CERTIFIED EXPERT
Top Expert 2010

Commented:
So, you can apply as many GPOs as you like to an object and have all of them modify a specific setting. However, the last GPO that is processed will take precedence. Look up GPO processing precedence/order and you'll get a headful of fun info about how what you're trying to do works. Essentially, the GPO that is linked closest to the object that it's applying to will take precedence. If two GPOs are at the same level, you have to set which one you want to take precedence in GPMC.msc.

For your example, In OU 1, OU 2, OU 3, with GPO 1 at OU 1, and on with matching numbers and a target object in OU3, GPO 3 would apply to EFGH, GPO 1 would apply to ABCD, GPO 2 would not apply to anything because it has lower precedence than GPO 3. Objects in OU2 would pick up GPO2's settings, but GPO 3 would override it in OU 3. Make sense?
Fred MarshallPrincipal
CERTIFIED EXPERT

Author

Commented:
Adam Brown:  Thank you!  Yes, that makes sense.  But, at the moment, I wasn't concerned about precedence.  I'm concerned about structure as I tried to describe.

I need GPOs to apply to different, overlapping collections of objects.  By definition, these cannot all be OUs as each object can only be in a single OU.
Also, one can't apply GPOs to Groups - so Groups are no help here that I can tell.
I have resorted to listing excepted Users or Computers individually and applying DENY.  At least that deals with potential overlap in OU memberships.  But, what if the ALLOW OU has 100% of the population and and the fictional DENY OU has 50% of the population (so not allowed as OU membership)?  Listing things individually would be rather prohibitive.

This is all about structuring OUs and GPOs to deal with a very real set of objectives / situation.
Senior Systems Admin
CERTIFIED EXPERT
Top Expert 2010
Commented:
You can filter GPOs so that they apply to specific groups of objects with Security Filtering in GPMC. You'd link the GPO to an OU and restrict permission to apply the GPO using Security Filtering (Or in some rare cases, Advanced Security ACL in the GPO itself). If you have objects in dispersed OUs, you would link the GPO to an OU that is high enough in the hierarchy that it covers all the objects or link the GPO to all OUs with objects that need to apply the settings.

You can also use WMI filtering for computer objects that will only allow processing for computers with specific hardware or software and other WMI-based attributes.

OU structure takes a lot of good strategy and understanding of precedence, but there are some good rules to follow. Computers and Users need to be separated in most situations. Deny and inheritence blocks should be avoided if possible. Policy Enforcement is also something to avoid. How you handle this depends very much on the needs of the organization. There's no one-size-fits-all solution for OU structure and GPO strategy.
Fred MarshallPrincipal
CERTIFIED EXPERT

Author

Commented:
Thank you!