GPPs - Item level targeting does not update with AD OU name changes?

[sparkeh]

Ok, so to explain the title:

 

I have noticed that if you use GPPs and specify OU membership as a condition, and then change the name of the OU, the query in the ILT no longer works. This might sound sensible, however if you use a security group as a condition and change the name of the security group, the condition is auto updated to reflect the new name (I guess it references a SID rather than the absolute name).

 

Has anyone else noticed this? Should it work this way?

[DavR]

Yeah, I've noticed the same thing, it's normal behavior.

 

As you quite rightly point out, the filtering on group is based on the SID, of which the group "name" is only ever a mask on top of the true object. Filtering by OU though is done on a text string, not sure how exactly, maybe an LDAP query, as I presume OUs don't have a SID to use in the same way.

[sparkeh]

Funny thing is I've never seen this documented or mentioned before. I now have to trawl through our group policies to make sure there aren't any other mistakes. :S

[DavR]

Yeah, one of those little quirks to be aware of I guess. Which is all well and good to know AFTER you've renamed a load of OUs I'm sure!