I want to create software deployment GPO for active directory users. Every new computer added to the active directory appear in container called "Computers" (in Active directory users and groups), I want to use this "Computers" container for security filtering on the GPO so that every new PC added to the AD will get software deployment GPO and I will not have to manually add it for every new PC. I noticed that I can't use "Computers" container as an object for security filtering and I don't know what to use instead to avoid manually adding new PCs to the GPO.

Here is some screenshots to better understand that I want to do:

"Computers" Container in Users and Groups

Can't Add Computers in Security filtering


I think you're confusing GPO security filtering and GPO hierarchical scope. The security filtering ACLs only deal with accounts and groups, never with containers. On the other hand, GPOs can be linked directly underneath any OU (though not underneath built-in containers) without the need for security filtering. Groups and containers are not the same thing.

So if you want a GPO to apply to all computers, you don't need to mess around with security filtering at all. The default GPO security filtering ACLs already allow the GPO to be applied to any user and any computer. (You probably removed those unnecessarily.)

(But if for some reason you want a GPO to be only reachable by machine accounts but not directly by users, then you can use the built-in Domain Computers group that all machine accounts are members of.)

And just like you already have organizational units for your users, you should do the same for your computers – don't simply dump them all under the "Computers" container... If the GPO must be applied to all PCs, just link it at the domain root, but if it must be applied to specific PCs only, move them to their respective OU and link the policy underneath that OU.

  • For some reason I thought that Domain Computers group would contain my domain controllers too, which I did not want. You made things clear for me, Thank you a lot! – CHEWKOK Jun 3 at 20:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.