Not only can you add AD Security Groups into the Security Filtering section, you can add individual user or computer objects as well! For my Set Desktop Wallpaper to Orange 2 GPO, I would like to test this GPO out on just a couple of users prior to rolling it out to the entire AD group. As can be seen in the following, I have security filtered this GPO to only two specific user accounts, so that those employees can test this setting and make sure it is working properly. Only these two user accounts will receive these GPO settings at the moment. This capability can also be very useful for testing out new security settings that you want to roll out to computers, or to servers. You need to be very careful before allowing any GPO to roll out to a server, lest you hose that server. Filtering a GPO to an individual machine for testing before making that filtering more widespread can save your bacon!