Any limitation for adding indivisual Object i.e Computer/users in security filtering

brajkishor Singh 1

Hi All,

Just to confirm is there any limitation for adding individual Object into security filtering .

Pls share if any relevant article for the same

Regards

brajkishor Singh 1 Reputation point

2022-08-29T04:27:42.07+00:00

in GPO security filtering

1 answer

Gary Reynolds 9,406 Reputation points

2022-08-29T10:27:07.937+00:00

Hi,

Have a look at this article which explains how to set the permissions on GPO, which will control which GPO are applied. While this refers to computers, the same is true for users as well.

As for limitation, you can add users, computers, or groups to the permissions. It's better to add groups rather than individual users or computers to the permissions, as it limits the number of entries and simplifies the management as groups tend not to be deleted.

https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-firewall/assign-security-group-filters-to-the-gpo

Gary.
Please sign in to rate this answer.
brajkishor Singh 1 Reputation point

2022-08-29T13:45:00.217+00:00

Thanks for your response ,I appreciate your kind help

I am curious to know if there any limitation for adding individual object and what mechanism work behind security filtering object limitation .I know we can achieve by adding security groups in GPO security filtering .But need to know if any limitation there and how many object we can add individually

Regards

Gary Reynolds 9,406 Reputation points

2022-08-31T11:55:59.583+00:00

There is no fixed maximum number of permissions that can be assigned, it is based on the size of the data written to the ntSecurityDescriptor attribute, and its difficult to define the exact number as permissions require different space allocation. The ntSecurityDescriptor attribute has a size limit of 132092 - https://learn.microsoft.com/en-us/windows/win32/adschema/a-ntsecuritydescriptor

However it appears that actual size of the security desciptor is limited to about 64K. Based on the size of the permissions to assign a GPO, this equates to roughly ~920 permissions. Assigning this number of permissions could cause significant performance issues when accessing the objects.

This article provides the details on how to assign the permissions - https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-firewall/assign-security-group-filters-to-the-gpo

The GPOs based on the location of the computer and user objects and what GPOs have been assigned to the OU structure. The GPOs are applied by the computer or the user if they are able to read the policy and the Apply group policy right is assigned, either to an explicit permission or via a group they are a member of.

Gary.

brajkishor Singh 1 Reputation point

2022-09-01T10:53:58.597+00:00

Thanks for your valuable input is it possible to check ntSecurityDescriptor attribute value via powershell or do we have any other workaround to check the default value.

Gary Reynolds 9,406 Reputation points

2022-09-01T10:58:20.487+00:00

Not sure what you mean by check the value with powershell or use a workaround, what information are you trying to get?
Sign in to comment

Share via

Any limitation for adding indivisual Object i.e Computer/users in security filtering

1 answer