undomiel wrote: GPOs are applied to the OU and by default are applied to all authenticated users (simple answer is everyone) and then you can use security filtering to narrow the scope to particular user or computer accounts or even security groups if you so choose.
