Haven't heard back from anyone on this issue, I know it's been a while, but we're still seeing it, and it's getting to be much more of an issue as we start migrating production servers over to the AD domain. How can we use multiple group policies to define security rights? Or do I need to do a single group policy per server, which seems awful.
In my testing, I found that it does not appear that Access control GPOs are cumulative. So, the GPO on the OU closest to the computer object will win. So I put a general GPO at the top of the structure and have just instructed down-OU admins that when they write GPOs for their OUs they have to include what the top level one has in it, in addition to what they need to add, to ensure global access continues for the "uber admins" and they can add access to service accounts and other service level users. It's a drag, but it seems to work. -----Original Message----- From: Max DiOrio <mdiorio(a)gmail.com&gt; Sent: Wednesday, June 20, 2018 9:08 AM To: End-user discussions about the System Security Services Daemon <sssd-users(a)lists.fedorahosted.org&gt; Subject: [SSSD-users] Re: Multiple GPOs and order processing issue Haven't heard back from anyone on this issue, I know it's been a while, but we're still seeing it, and it's getting to be much more of an issue as we start migrating production servers over to the AD domain. How can we use multiple group policies to define security rights? Or do I need to do a single group policy per server, which seems awful.