Lately, we have been deploying XenApp servers using Citrix Provisioning Services. This is a great tool, that we have only just started using.
In our current process, we are creating a group of machines using PVS. When they come up, the join the farm and by virtue of the AD OU they are in, they become members of a worker group. We are also creating machines for test purposes that we want to get the same Group Policies, but we don’t want them to be in the worker group by default. We deploy the production apps to the Worker Groups, but not to individual machines. If the test machines are part of the Worker Groups, then the apps are also published to the test machines.
To prevent this, we created a sub OU to put the particular test machines in, so they would get the Group Policies, but not have the apps automatically published to them. Except that the machines wouldn’t come out of the Worker Group…
Turns out, if the machines joined the farm in the OU that the Worker Group is looking at, they will remain in the worker group. In order to correct this, you simply remove the offending machines from the farm. When they come back up and join the farm again, they are no longer part of the worker group. (As long as the machine accounts aren’t in the target OU.)