windows-server-2008 – GPO中计算机配置和用户配置的区别

Lets say I have two OU’s one to store computer objects and the other to store User accounts. If I create a GPO in the “Computers” OU,and set user configurations,will they take effect?

不,我的意思是,除非您将用户帐户对象存储在名为Computers的OU中,这很奇怪……

GPO的用户设置仅会影响位于GPO链接范围内的OU中的用户帐户.

计算机设置只会影响位于GPO链接范围内的OU中的计算机帐户.

如果您希望优化GPO处理,可以关闭GPO的计算机设置或用户设置部分……但我不会经常在野外看到这种做法.

你可以这样做：

Toronto (OU)
   |
   +- Users (OU)
   |
   +- Computers (OU)

在Toronto OU,您可以链接包含用户和计算机设置的GPO,这些设置适用于多伦多的所有用户和计算机对象.然后,您可以将GPO链接到仅包含用户设置的用户OU,并将另一个GPO链接到仅包含计算机设置的计算机OU. (当然,假设您只在用户OU中存储用户帐户对象,而在计算机OU中仅存储计算机帐户对象.)

那当然只是一个例子.还有其他一百种方法可以设计组策略和OU布局.

编辑：Greg Askew提出了一个很好的观点,(谢谢),那就是您现在可能想知道组策略的回顾处理.简单说明Microsoft：

You can use the Group Policy loopback feature to apply Group Policy Objects (GPOs) that depend only on which computer the user logs on to. … This policy directs the system to apply the set of GPOs for the computer to any user who logs on to a computer affected by this policy. This policy is intended for special-use computers where you must modify the user policy based on the computer that is being used. For example,computers in public areas,in laboratories,and in classrooms.