Apply-Policy-Everywhere

Apply-Policy-Everywhere

Adds a link to the "Computer: Block logon by AuthLite 1-Factor Session Tag" policy at any OUs that have inheritance blocked. This is almost always the correct thing to do, since leaving the policy un-applied there would make a security hole. (An attacker could authenticate with 1-factor under the inherit block, but then use their kerberos ticket to attack machines that would otherwise have enforced 2FA).

We preferentially use this strategy of linking the policy under the inherit blocks because as a script it is easy to apply this way. Using the "Enforced" feature of group policy on the other hand would flip the inheritance hierarchy and make things harder to manage in general.

If you prefer to use Enforcement or need to make an OU exempt from receiving the policy, you can still make those changes. These scripts are only to set up a normal baseline of best practice.

Note: The way we set this up, without Enforcement, means that if you frequently create new inheritance-blocked OUs, you should manually link the AuthLite policy under each one, otherwise the new OUs won't see the policy.