How to correctly assign gpo to a group?

Question

Active Directory

I have windows server 2012 r2. In the OU "Group" the group "buh_pk" was created, which includes PCs that are in the OU "Workstation". I create GPO "add printer" , set security filter "buh_pk" read and execute. And I bind the gpo to the OU "Group" , but the policy is not applied

Answer 1

The policy needs to be tied to the container where the PCs are, and not to where the group is.

Answer 2

the error is that gpo is attached to ou where users and/or computers lie, not groups.
and then, in the settings of the gpo itself, you can filter the security in order to filter out people (groups) to whom this policy should not be applied.
but it's easier to create a separate accounting ou and drop the PC and / or users to which you want to apply the policy there.