Documentation forAccess Rights Manager

Link a GPO to organizational units

A Group Policy Object (GPO) applies only to the organizational units (OUs) or domains that it is linked to. In the ARM web client, you can link a GPO to one or more OUs or to the entire domain, and you can remove existing links. You can link a GPO when you create it or when you edit it.

To link GPOs, you need an ARM role with write access in the web client and membership in Domain Admins, Enterprise Admins, Group Policy Creator Owners, or BUILTIN\Administrators in the target domain. The OU tree is read directly from Active Directory using the credential described in Group Policy Objects (GPOs) in the web client.

Linking a GPO or removing a link changes the gpLink attribute of the OU in your production Active Directory. The GPO settings are applied to, or removed from, all users and computers in the OU at the next Group Policy refresh.

  1. In the web client main menu, click GPO, and then click the domain.

  2. Do one of the following:

    • To link a new GPO, click Create New GPO.
    • To link an existing GPO, select the GPO and click Edit.

  3. In Link to Organizational Units, select the OUs to link the GPO to.

    • To link the GPO to the entire domain, select the domain. The message "Entire domain selected (applies to all OUs)" is displayed.
    • To remove an existing link, clear the OU.

  4. Save your changes.

ARM updates the OU links in Active Directory and in the ARM data. The link path of the GPO shows the new links.

To see which GPOs apply to an OU, run the Effective Policies report. See GPO reports.