Apply a GP to only a certain group, which contains sub groups of computers and users

[googlemad]

I'm trying to set up certificate based authentication for our WiFi using a Windows CA, which is all good and working. I've set up a Group Policy for user/computer certificate auto enrolment and credential roaming.

 

My plan was this :-

 

Various wireless groups in AD (e.g. WIFI_SSID1, WIFI_SSID2, WIFI_SSID3) - users and computer objects would be added to these groups which would then allow them access to the wireless SSID in question

 

Then I would have a 'WIFI_GROUPS' group, and the members of that group would be the groups as per above (so WIFI_SSID1 etc.), so no users and computers in this group just the sub groups which then obviously contain the users and computers.

 

Then only apply the Group Policy to the 'WIFI_GROUPS' group, which would then filter out the policy to any users and computers within the sub groups of that group.

 

Is this possible or am I going completely mad?!

[Oaktech]

I'm not 100% I'm following you, but it sounds like you'll need to restrict the scope of your GPO to specific groups rather than 'authenticated users' like it is for default.

[psydii]

Yes this would work. You are basically implementing "role based access control" See the 2008 Resource Kit book: https://www.amazon.co.uk/Windows%C2%AE-Administration-Resource-Kit-Professionals/dp/0735624313

and the follow up presentations on the topic: https://channel9.msdn.com/Events/TechEd/NorthAmerica/2010/WSV301. For the deep theory, you can read one of the original papers from NIST: https://csrc.nist.gov/CSRC/media/Projects/Role-Based-Access-Control/documents/sandhu96.pdf for the original 1995 paper.