Apply from domains down to organizational units in aDirectory.

Create objects associated to organizational units (OUs) in aDirectory -- via the Group Policy Editor .

Secure 'Group Policy Objects' (GPOs) with NTFS permissions in the same fashion as files and folders.

See Group Policy in Ch14.