A domain policy should affect only servers in a dedicated organizational unit. What is the best design?

1. Link it to the domain root and assume its name limits scope
2. Copy the GPO file into each user's documents folder
3. Link the GPO to the intended OU and verify filtering and inheritance
4. Change DNS forwarding instead