Okay.
Now I'm going to shift gears and talk about group policy targeting.
So remember from module one I said the GPOs are processed or pulled by user objects or computer objects
and add only.
In other words, it's only user objects and computer objects that are affected by a group policy and
that can be targeted by group policy.
So what that relates to is, let's say I have a user in the marketing users, O.U.
And I have a GPL that defines some settings under user configuration policies, whatever administrative
templates or security or preferences.
Those user configuration settings are processed by the user object only.
In other words, the user object is the thing I'm targeting.
Likewise, if I have a computer object in AD in the marketing computers, you need to find a GPO that
has computer configuration settings underneath it.
Then those will be processed by that computer object.
And it's kind of a key concept to understand, and it's one that often confuses people in terms of targeting
GPOs.
You want to target user objects to the stuff under user configuration and you want to target computer
objects to the stuff under computer configuration within a GPO.
So it's kind of an important fundamental thing.
So everything under computer configuration in the GPO editor only applies to computer objects, and
everything under user configuration only applies to user objects.
And once you keep that concept straight, the targeting or the mis targeting of policy becomes a lot
easier to to work through.
So this is a really important point, and I'm just I'm going to say it again.
Computer objects.
Processed stuff under computer configuration.
User objects process stuff under user configuration within a GPO.
So what's the lesson you can't link?
And I'm going to talk about linking in a second.
You can't link a GPO containing user settings to an O you filled with computers.
Nothing's going to happen.
The computers will ignore the settings that show up under user configuration within that GPO.
So what does that look like?
I've got a computer in my marketing computers.
And I'm basically saying if I see a GP and it's got user configuration settings in it, I'm just going
to ignore it.
It doesn't apply to me because I'm a computer.
I'm not a user.
And I don't know how to do anything with user configuration settings.
So that's essentially the key point that I wanted to bring home in this section.