Group Policy Inheritance

[Arrow_Runner]

First off, I finally got a real IT job!

Anyhow, I'm going to be "sprucing up" the 2003 AD here, but I can't figure out how or if this is even possible.

Here's just a few of our departments:

Accounting

IT

Training

Call Center

Marketing

Management

In AD, I'd like to make GPOs for each of these. Unfortunately, some employees occasionally do work outside of their department. For instance, a person from the Call Center will assist with training.

Therefore, I can't just put everyone in their respective department OU and call it a day because they may need something that I have locked for their department but open for another that they may occasionally do work for.

I thought I could create OUs for each dept, then make a group under each OU, and make a computer/user a security member of each group he/she/it needed to belong to so all the desired GPOs would be applied to him/her/it, but it doesn't seem to work like that.

There has to be a good way to do this. I don't want to have to create a bunch of nested/linked OUs for 2 people out of each department.

[olocin]

What are the task the Call Center person do with the Training Group, you have to indentify first the common task of both, if the adjustment you'll make is on their username or assign a different user specifically for both departments

[Bad boy Warrior]

From my experience i found that you have to have the right balance with OU, GPOs etc. We have something like:

Admin

Sales

Purchase

Human Resource

IT

Finance

For each department i have two further OUs, Computers and LaptopUsers. I have one separate policy that is applied to all Computers, Users and laptops. Then i use "security filtering" and apply certain settings to certain users.

Maybe this article can help http://www.windowsnetworking.com/articles_...-Filtering.html

[olocin]

Use Group Policy Management Console.

[Arrow_Runner]

http://www.windowsnetworking.com/articles_...-Filtering.html

That's exactly what I was looking for, thanks!