Mastering Windows Group Policy

Filtering GPOs with security filters

A newly created GPO does not apply its settings to anybody or anything until you link that GPO to a particular location, such as an OU. Once linked, that GPO then typically starts applying to everything listed underneath that OU. In the case of a domain-level link, this is even more widespread as GPOs linked at the root of the domain will, by default, attempt to apply themselves to everything within the domain (other than OUs where inherency blocking is enabled, as we already discussed). All of this sounds good if your intentions are for these GPO settings to roll around to that many people and workstations, but there are instances when you create GPOs that only need to apply to particular groups of computers ...