By default, a new GPO applies to every user. Therefore, a new GPO has just one filter named Authenticated Users. You must filter each policy to apply to users, groups, and computers you want.
NOTE:By default, every GPO is assigned to the Authenticated Users group.
To adjust filtering and manage the assignment of users, groups, and computers to a GPO:
Log on to a GPA Console computer.
Start the GPA Console in the Group Policy Administrator program group.
In the left pane, expand GP Explorer to the GPO.
Click the Filters tab in the right pane.
Review the effective security filters displayed in the right pane.
Select the GPO in the left pane.
On the Action menu, click Properties.
If you need to add a user, group, or computer to the list of filters, perform the following steps on the Delegation tab:
Click Add.
Select the appropriate domain in the From this location field. The default location is the parent domain, even if you are connected to a child domain. Make sure you are selecting an object from the appropriate domain.
Select the user, group, or computer to add, and then click OK. You can repeat this step multiple times to add multiple objects to the filter.
Select the Receive Settings [Read, Apply] permissions for the selected group or user, and then click OK.
When you have finished adjusting the filters to the GPO, click Apply, and then click OK.