Manage GPOs - MCSA Windows Server 2012 R2: Installation and Configuration Study Guide - page 310

■ Create All Child Objects
■ Delete All Child Objects
■ Apply Group Policy
You might have to scroll the Permissions window to see the Apply Group Policy item.
Of these, the Apply Group Policy setting is particularly important because you use it to
filter the scope of the GPO. Filtering is the process by which selected security groups are
included or excluded from the effects of the GPOs. To specify that the settings should
apply to a GPO, you should select the Allow check box for both the Apply Group Policy
setting and the Read setting. These settings will be applied only if the security group is also
contained within a site, domain, or OU to which the GPO is linked. To disable GPO access
for a group, choose Deny for both of these settings. Finally, if you do not want to specify
either Allow or Deny, leave both boxes blank. This is effectively the same as having no
setting.
In Exercise 6.3, you will filter Group Policy using security groups. To complete the steps
in this exercise, you must have completed Exercises 6.1 and 6.2.

exercise 6.3

filtering Group Policy using security Groups

1. Open the Active Directory Users and Computers administrative tool.

2.

Create a new OU called Group Policy Test .

3. Create two new global security groups within the Group Policy Test OU and name them

Policyenabled and Policydisabled .

4.

Exit Active Directory Users and Computers and open the GPMC.

5. Right-click the Group Policy Test OU and select Link An Existing GPO.

6.

Choose Unlinked Test GPO and click OK.

7. Expand the Group Policy Test OU so that you can see the GPO (Unlinked Test GPO)

underneath the OU.

8.

Click the Delegation tab and then click the Advanced button in the lower-right corner of
the window.

9. Click the Add button and type Policyenabled in the Enter The Object Names To Select

field. Click the Check Names button. Then click OK.

10. Add a group named Policydisabled in the same way.

11. Highlight the PolicyEnabled group and select Allow for the Read and Apply Group Policy
permissions. This ensures that users in the PolicyEnabled group will be affected by this
policy.