[gptalk] Group Policy Scoping

  • From: "Johnson, Matthew" <mjohnson@xxxxxxxx>
  • To: <gptalk@xxxxxxxxxxxxx>
  • Date: Mon, 15 Oct 2007 17:06:05 -0400

Our Domain structure is setup so that we have many departmental OU's and
one OU for Servers.  Each Dept. OU contains one OU for Computers and one
for Users.


We have GPOs linked to the root domain that apply to both workstations
and servers, but want to setup additional GPOs that apply to just
servers or just workstations.  GPOs for just Servers are easy because we
can link them to the Server OU.  The problem occurs when we want to
apply a GPO to just workstations.  We are running a Windows 2000 mixed
domain function level so we cannot use WMI filtering to specify what OS.


Here is what I've thought of so far.

1)      We could link the GPO to every Dept. OU but there is quite a few
and that seems sloppy and harder to manage.

2)      We could Block Inheritance on my Servers OU and link the
workstation GPOs to the root domain.  But then I would have to link the
common GPOs (GPOs that I want to apply to both servers and workstations)
to the Server OU also.

3)      We could just bite the bullet and upgrade to Windows 2003 domain
function level to enable WMI filtering


Does anyone have any suggestions?  How is everyone else doing this?


Thanks for any help.


Matthew Johnson


CONFIDENTIALITY STATEMENT: This electronic message contains information from 
Fisher-Titus Medical Center and 
may be protected health information or other confidential and privileged 
information under law.  
The information is intended to be for the use of the individual or entity named 
If you are not the intended recipient, be aware that any disclosure, 
copying, distribution or use of the contents of this message is prohibited. 
If you have received this electronic message in error, 
please notify the sender immediately by reply e-mail or telephone at 

Other related posts: