Why is the GPO not applied per group?

Question

Active Directory

I'm trying to apply a GPO on OU Astana-group which contains only the cool-group group, which in turn contains the Yessen user to which I want to apply the policy (yes, there's no other way to explain it here ...) but the GPO is not applied in this way, but if I move Yessen user in OU Astana-group only in this case the policy will work what's the problem?

Answer 1

A GPO is always applied to an OU, and can only be filtered and applied to members of a particular group of objects residing in the OU to which the GPO is linked.