Windows Server® 2012 Unleashed

Group Policies and OU Design

Administrators create group policies to limit users from performing certain tasks or to automatically set up specific functionality. For example, a group policy can be established to display a legal disclosure to all users who attempt to log on to a system, or it can be set up to limit access to the command prompt. Group policies can be set on AD DS sites, domains, and OUs, but can also be configured to apply specifically to groups. This functionality increases the domain designer’s flexibility to apply group policies.

As previously mentioned in this chapter, creating additional OUs simply to apply multiple group policies is not an efficient use of OU structure and can lead to overuse of OUs in general. Rather, you ...