(1)创建usersOU影子组,然后把这个影子组加入到testgp就可以了
参考:
http://policelli.com/blog/archive/2008/01/15/manage-shadow-groups-in-windows-server-2008/
http://ravingroo.com/458/active-directory-shadow-group-automatically-add-ou-users-membership/
---------------------------------------------------------------------------------------
(2) 考虑用powershell脚本,在Powershell的AD模块中有get-aduser和set-aduser两个命令,可以尝试试一试;