Static and dynamic groups
You can explicitly specify which machines the custom group has to include, for example, let’s say, select each of the accountants’ machines. Once you apply the accounting department policy to the group, the accountants’ machines become protected. If a new accountant is hired, you will have to add the new machine to the group manually. Such groups are called static since their content never changes unless the administrator explicitly adds or deletes a machine.
Manual operation is not required though, if the accounting department forms a separate Active Directory organization unit. You specify the accounting OU as the group membership criterion. If a new accountant is hired, the new machine will be added to the group as soon as it is added to the OU, and thus will be protected automatically. Such groups are called dynamic since their content changes automatically.