What is an Organizational Unit (OU) and how does Group Policy apply to OUs?

• A. An OU is a security boundary similar to a domain.
• B. An OU is a container for organizing users and computers; GPOs linked to an OU apply policies to its objects and can be overridden by child OUs unless blocked.
• C. An OU is a group of users with delegated permissions.
• D. An OU is a container to organize objects; GPOs linked to an OU apply policies to its objects and can be overridden by child OUs unless blocked.

Answer: (D)

An Organizational Unit is a container within Active Directory used to group objects so you can manage them together. Group Policy Objects linked to an OU apply to the objects inside that OU, and those policies flow down to child OUs unless inheritance is blocked on the child. It’s also important to note that OUs aren’t a security boundary like a domain—the domain defines the security boundary, while OUs handle organization and delegation. OUs can contain various object types, not just users and computers, so describing them as containers for organizing users and computers is too narrow. The precise and complete description—an OU is a container to organize objects; GPOs linked to an OU apply policies to its objects and can be overridden by child OUs unless blocked—best captures how OUs and Group Policy actually work.