To make this clear
to everyone.
Yes a user can be
in more than one group. The question you are asking is can a GPO be
applied to a groups? - NO
Read MS article
322176: http://support.microsoft.com/?kbid=322176
Hope that this
helps,
Jason
Crenshaw
Sandia National
Laboratories
____________________________________________________________________________________________________________________________
Short
Answer:
NOTE:
GPOs are applied only to sites, domains, and organizational units. Group
Policy settings affect only the users and the computers that they contain.
Specifically, GPOs are not applied to security groups.
The location
of a security group in Active Directory does not affect filtering through
that security group as it is described in this procedure.
If a user
or a computer is not contained in a site, a domain, or an organizational
unit that is subject to a GPO either directly through a link, or indirectly
through inheritance, you cannot set any combination of permissions on any
security group to make those Group Policy settings affect that user or
computer.
Filtering at the GPO level, as it is described in this
procedure, causes the GPO to be processed or not processed as a whole. The
Software Installation extension and the Folder Redirection extension use
security groups to refine control beyond the GPO level. Except for Folder
Redirection and Software Installation, security groups are not used to
filter individual settings or subsets of a GPO. For control over individual
settings, edit or create a GPO instead.
-----Original
Message-----
From: Chris
Flesher [mailto:[EMAIL PROTECTED]
Sent: Monday, July 21, 2003 12:18
PM
To:
[EMAIL PROTECTED]
Subject: RE: [ActiveDir] Group Policy
question
a user
can be a member of more then one group. if a user is a member of two groups
that are in seperate OU's, then the user can have group policy applied to
two seperate groups based on ACL's within each OU? I don't need an object
existing in two seperate OU's. I just need two seperate groups with a user
being in each group, with each group in seperate OU's.
Chris Flesher
The University of
Chicago
NSIT/DCS
1-773-834-8477
-----Original
Message-----
From:
[EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Crenshaw,
Jason
Sent: Monday, July
21, 2003 12:38 PM
To:
'[EMAIL PROTECTED]'
Subject: RE: [ActiveDir] Group Policy
question
What is group policy or a GPO?
Group policy is a new Windows term
for common configuration settings. An administrator can create a group
policy which applies to users or computers. This group policy can set
certain computer settings such as who can login to the computer or user
settings such whether the user can run control panel applets. Group policy
is similar to what was called policy in NT4, but there is a vastly
improved performance together with a greater number of common
configuration settings. A GPO, or group policy object, is a set of
settings applied to a site, domain or OU container. The GPO then is
applied to every machine or user object under that container. One can
configure a GPO with ACLs to restrict the computers or users to which it
is applied.
This
also suggests that it is technically impossible to do since a user object
can only exist in one container or OU.
Hope
that this answers your question.
Jason
-----Original
Message-----
From: Roger
Seielstad [mailto:[EMAIL PROTECTED]
Sent: Monday, July 21, 2003 11:29
AM
To:
'[EMAIL PROTECTED]'
Subject: RE: [ActiveDir] Group Policy
question
I
believe there's nothing in TechNet on it because its technically
impossible to do. You can't have an object in more than one
OU.
--------------------------------------------------------------
Roger D.
Seielstad - MTS MCSE MS-MVP
Sr.
Systems Administrator
Inovis
Inc.
-----Original
Message-----
From:
Chris Flesher [mailto:[EMAIL PROTECTED]
Sent: Monday, July 21, 2003 12:49
PM
To:
[EMAIL PROTECTED]
Subject: RE: [ActiveDir] Group
Policy question
Guido, that's
not quite what I had in mind. Two OU's that are not hierarchical to each
other. It could be a flat OU architecture. Two seperate OU's that have
gpo's applied to a group. If a user is a member of both groups, which
gpo will take precedence? Maybe it's a dumb question but it was posed to
me by a higher up and I can't find anything about this scenario in
technet.
Chris
Flesher
The University
of Chicago
NSIT/DCS
1-773-834-8477
-----Original
Message-----
From:
[EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of GRILLENMEIER,GUIDO
(HP-Germany,ex1)
Sent: Monday, July 21, 2003 10:43
AM
To:
[EMAIL PROTECTED]
Subject: RE: [ActiveDir] Group
Policy question
I guess
you're using the groups to filter for whom a GPO is applied - but
you're not applying a GPO to a group ;-) It doesn't matter which
OU the group resides in, it simply matters, which OU the respective
GPO is applied to.
Assuming
you're talking about applying two GPOs to the same OU - each with a
separate Group used for filtering, then you can set the priority of
the GPO processing order directly on the OU on the Group Policy
tab.
From:
Chris Flesher [mailto:[EMAIL PROTECTED]
Sent: Montag, 21. Juli 2003
17:18
To:
[EMAIL PROTECTED]
Scenario: a
user is a member of two groups. Each group is in a seperate OU. A gpo
is applied to each group. Which gpo will take precedence for that
user? In other words, which will be the last to be applied and get the
settings applied to that user?
Chris
Flesher
The
University of Chicago
NSIT/DCS
1-773-834-8477
