Active Directory Administration Cookbook

How it works...

By default, all Group Policy Objects have the GpoApply permission assigned to the Authenticated Users group. This permission can be scoped down to a certain group by removing the default permission and adding a scoped group. When the GpoApply permission is absent, the settings in the GPO don't apply to each of its GPO links.

Since groups can be nested, security filtering can make Group Policy processing slow, especially in multi-forest environments.