Missing rights for item-level targeting?

[erich]

I have rights in a domain, "DomA", to create and link GPOs to specific OUs in that domain. I want to push out shared printers via GPP and use item-level targeting to filter who gets which printer by group membership. I have full rights to those OUs and GPOs, very basic rights to the rest of DomA, and default rights to all of another domain, "DomB".

The problem is I can only see DomB when I click on the "..." button in the targeting editor. It doesn't matter if the printer is in DomA or DomB, I cannot see the groups in DomA (which both the GPO/GPP and my account are objects in).

I assume there are some missing right(s) to something in DomA. Does anybody have any suggestions?

Thanks.

[erich]

Since nobody here is answering, I thought I would post an update...

Turns out, the objects (groups at least) you can select from for item-level targeting have to be in the same domain as the workstation you are sitting at.

This is a crazy requirement and a bug in my opinion. I was able to accomplish what I needed by trying the same thing on a machine in the same domain as the group I was trying to target.

So with this:
In DomainA: the GPO, all groups and users (me too), the GPO linked OU, WorkstationA
In DomainB: WorkstationB, the printer to deploy

The groups can be the target of a GPP if I use WorkstationA, but not if I use WorkstationB. If I wish to target groups in both domains (for some crazy reason), I have to edit the GPO from two different workstations!

I hope this helps someone down the road (or that MS fixes this).

Erich