OK, the title probably made no sense...

I need to run a shutdown script that installs an exe on a couple hundred machines at our branch office.

In my AD setup (just a test VMware box right now) I have created an OU called 'Test' where I applied the GPO. Now, if the computers are inside this OU, the GPO gets applied to them, the script runs on the computer during shutdown, everything is good.

But, when we hit the production network, we don't want to move these computers into a new OU just to make this work. We also don't want to roll out the GPO on ALL the computers at once, just select ones to start. Slowly we'll be adding computers about 30 at a time.

I created a security group and put it in the Test OU where the GPO is applied. I've added the computers in the default 'Computer' container to this security group. The computers do not get the GPO applied to them.

Under the GPO Security Settings (looking under 'Delegation Tab --> Advanced) I have the security group with ALL permissions set, except 'Full Control', 'Special Permissions', and obviously I don't have any Deny ones checked.

I'm 3 weeks on the job here. It's a lot of fun, but obviously I didn't learn everything I needed in school I've been fighting with this for a while, is there anyone here who can shed some light on it for me? Any help would be greatly appreciated! I'll continue googling around too, maybe I just haven't put in the right search strings yet.


Thanks so much!


Dave