OK, we have ~100 clients still on Windows XP and ~300 clients on Windows 7. We're in the midst of a Group Policy revamp that also involves reorganizing the Active Directory OU structure also. Our new AD structure resembles the following:
Workstations
>> Desktops
>> Laptops
Servers
All of our Windows XP and Windows 7 workstations are dispersed among the Desktop and Laptop OU's with the majority of GP settings being applied via a GPO linked to the Workstations OU, including the firewall settings. The issue is Windows Firewall with Advanced Security settings in the GPO (Computer Configuration > Windows Settings > Security Settings > Windows Firewall with Advanced Security) are only applied to the Windows 7 workstations and the Windows XP workstations receive nothing since their firewall settings are received via the settings under the Admin Templates section (Computer Configuration > Administrative Templates > Network > Network Connections > Windows Firewall). And if we attempt to apply firewall settings in this location the Windows XP workstations receive the correct settings and the settings on the Windows 7 machines are not as granular as we would like them.
Whats the best method to work around this issue, other than immediately upgrading the remaining workstations to Windows XP workstations to Windows 7? Create separate Windows XP / Windows 7 OU's and apply firewall settings at this OU level? Or use some type of filtering? I've never dealt with GPO filtering to any major extent so if you recommend this method, any guidance would be most appreciated.