How to apply a GPO to a computers group

Question

I've just installed a "Windows Server Update Services" (WSUS) server in my company to provide updates to the Windows Server machines. Now I want to set a GPO in the servers OU to force them to get updates from the WSUS, but I'm not able to get it working. What I have done is:

• Created a GPO called "WSUS" with the required settings (which are under "Computer Configuration" > "Windows Components" > "Windows Update") at the keys "Specify intranet Microsoft update service location", "Configure Automatic Updates" and "Enable client-side targeting".
• Created an Organizational Unit of first level called "MyServers" and move my servers from the "Computers" container to this OU.
• Created a group called "MyServersGroup" inside that OU containing the computers inside "MyServers" (the OU and the group contain the same servers).
• Linked the GPO to the "MyServers" OU and, at the Security filters, added the "MyServersGroup" with the "Read" and "Apply group policy" permissions (I did not delete the "Autenticated users" group).
• Ran the "gpupdate /force" command in my Domain Controller server and then in one of my servers inside the "MyServers" OU, lets call it FileServer.

And the policy does not apply.

Instead of showing that policy applied, when I run "GPResult /F /H report.html" in the FileServer machine, the only policy applied is the "Default Domain Policy", which has some settings inside the "Computer Configuration" section but not at the keys I configured. That GPO is linked to the domain root, affecting only to the "Authenticated users" group.

In the report.html file the "WSUS" string does not even appear as the "Winning GPO" is always the "Default Domain Policy". Why can't my policy be applied? I don't understand why is this happening...

Edit: Now I have removed the "MyServersGroup" and configured the "Group Policy Modelling Wizard". It shows the WSUS policy being applied along with the default one, but in the FileServer the policy isn't applied yet (I ran the gpupdate in case it was necessary).

Solution

The group is not necessary: if you link the GPO to a OU and place your computers inside that OU, the GPO will automatically be applied to those computers and only those; you don't need a group for that.

What I think is happening: the GPO security filtering based on group membership is actually blocking the GPO from being applied, because the servers are not recognized as being members of that group until a reboot occurs (just as group membership is not refreshed for users until they log off and on again).

Comments

[BlueCompute]

The security group is unnecessary and confusing. Also you state that you 'linked the GPO to MyServersGroup OU' this is incorrect/unclear. Run Group Policy Modelling Wizard - does this show your GPO being applied?

[nicovell3]

Yes, it's being applied@BlueCompute... I didn't know about that feature (I'm new at this). Thanks for your advice!

[joeqwerty]

This is exactly what's happening. The servers need to be rebooted for the group membership to be effective and that's why the policy is not being applied. As you stated, the security group is completely unnecessary.

[nicovell3]

The group was unnecessary (I set it up because the policy wasn't being applied), but the policy isn't applied yet even after deleting the group and rebooting the server.

[nicovell3]

I didn't checked well the policy after the reboot... Finally it's working! Thanks!!