Here’s a cleaned-up, polished version of your article—formatted professionally for your company’s Knowledge Base while keeping it practical and technical:

---

📘 Mapping Network Drives via Group Policy in Windows Server 2022

Overview

This guide explains how to automatically map shared network folders as drives using Group Policy Preferences (GPP) on Windows Server 2022. It also covers the roles of Organizational Units (OUs) and Security Groups, along with best practices for scalable, flexible management.

---

🔧 Key Components & Requirements

Before proceeding, ensure the following:

• Windows Server 2022 domain environment
• Domain-joined client systems
• Users and computers are located in Organizational Units (OUs) (not default containers)
• Shared folders with proper NTFS and share permissions

---

🧩 Understanding OUs vs. Security Groups

Concept	Description
Organizational Units (OUs)	Logical containers for users, computers, and other OUs. They support GPO linkage and delegation of administrative rights.
Security Groups	Membership-based collections used for granting permissions (NTFS, shares) and GPP item-level targeting.

Key Differences:

• A user or computer can reside in only one OU at a time.
• Users can belong to multiple security groups simultaneously.
• OUs apply policies broadly and help delegate control.
• Groups grant granular access control and can span across OUs.

⚠️ Important: Default containers like Users and Computers do not support GPOs. Move all accounts into proper OUs for Group Policies to apply.

---

🏗️ Active Directory Structure Best Practices

a. Create Organizational Units

Method 1 – ADUC GUI:

1. Open Active Directory Users and Computers (ADUC).
2. Right-click the domain → New → Organizational Unit.
3. Name and optionally protect the OU from accidental deletion.

Method 2 – PowerShell:

New-ADOrganizationalUnit -Name "Sales" -Path "DC=contoso,DC=com"

---

b. Move Users and Computers to OUs

Via ADUC:
Select and drag users/computers into the desired OU.

Via PowerShell:

Get-ADUser jdoe | Move-ADObject -TargetPath "OU=Sales,DC=contoso,DC=com"

---

c. Create Security Groups

In ADUC:
Inside an OU → New → Group
Choose:

• Type: Security
• Scope: Global / Domain Local / Universal

Add user members as needed.

Users can belong to multiple groups for layered permissions and access control.

---

🗂️ Creating and Linking the Drive-Mapping GPO

1. Open Group Policy Management Console (GPMC).
2. Right-click the target OU or domain root →
   Create a GPO in this domain and Link it here…
3. Name it (e.g., Drive Maps – Universal).
4. Right-click the new GPO → Edit.
5. Navigate to:
   User Configuration → Preferences → Windows Settings → Drive Maps

---

⚙️ Configuring Drive Mapping (with Item-Level Targeting)

1. Right-click Drive Maps → New → Mapped Drive
2. On the General tab:

• Action: Create or Update
• Location: UNC path (e.g., \\Server\Share)
• Drive Letter: Choose desired letter
• Label: (Optional) Friendly name

1. On the Common tab:

• Check Run in logged-on user’s security context
• Enable Item-level targeting → Click Targeting…
• Add Security Group condition(s)

Optional enhancements:

• ✅ Remove this item when it is no longer applied – automatically unmaps drives when users leave a group.
• 🔁 Apply once and do not reapply – useful for one-time setups.

This allows one GPO to deploy multiple drive mappings, each targeted to different security groups, across any OU.

---

🔗 Linking and Applying the GPO

1. Link the GPO to the desired OU(s) or domain root.
2. On clients, run:

   gpupdate /force

or simply reboot.

Users who:

• Have their account within the linked OU, and
• Belong to one of the targeted Security Groups

will automatically receive the appropriate mapped drives.

---

🧰 Maintenance & Troubleshooting

• Verify GPO scope:

  gpresult /h report.html

or use

  Get-GPOReport

• Adjust mappings by changing security group membership, not by moving users between OUs.
• Keep GPOs modular—avoid editing the Default Domain Policy.
• Use Item-Level Targeting to minimize GPO clutter and boost performance.

---

📋 Summary Table

Task	Tool / Method	Notes
Create OU	ADUC / PowerShell	New-ADOrganizationalUnit
Move Accounts	ADUC / PowerShell	Move-ADObject
Create Security Group	ADUC	Add users, define scope
Link Drive-Mapping GPO	GPMC	User Config → Preferences → Drive Maps
Configure Mapped Drive	GPP + Targeting	Set UNC, drive letter, group conditions
Enable Cleanup Options	Within preference item	Use “Remove this item…” / “Apply once…”
Apply / Test Policy	Command line	gpupdate / gpresult
Maintain Setup	ADUC / PowerShell	Adjust memberships, review policies

---

💡 Final Thoughts

A user belongs to one OU, but can be part of many groups.
Using Item-Level Targeting with Security Groups enables flexible, modular, and scalable GPO management across OUs.

This approach:

• Simplifies administration
• Reduces GPO sprawl
• Keeps drive mappings logical and maintainable

Tip: Combine OUs for structure and Groups for control. That balance keeps your environment clean, efficient, and easy to scale.

---

Would you like me to format it for Markdown, Confluence, or SharePoint export? I can adjust the headings and table syntax accordingly.