Create and link a GPO from PowerShell

Clicking through GPMC is fine once. If you are doing the same policy across environments, script it so it is repeatable and reviewable.

Create, set a value, link

Import-Module GroupPolicy

$gpo = New-GPO -Name "Workstation - Screen Lock"

# 15 minute inactivity lock via registry-backed policy
Set-GPRegistryValue -Name $gpo.DisplayName `
  -Key "HKCU\Software\Policies\Microsoft\Windows\Control Panel\Desktop" `
  -ValueName "ScreenSaveTimeOut" -Type String -Value "900"

New-GPLink -Name $gpo.DisplayName `
  -Target "OU=Workstations,DC=corp,DC=example,DC=com" -LinkEnabled Yes

Scope it without moving objects

Rather than restructuring OUs, link broadly and filter with a security group. Deny "Apply group policy" to everyone except the target group, or set the GPO's security filtering to that group only:

Set-GPPermission -Name $gpo.DisplayName -TargetName "Domain Computers" `
  -TargetType Group -PermissionLevel None
Set-GPPermission -Name $gpo.DisplayName -TargetName "Kiosk PCs" `
  -TargetType Group -PermissionLevel GpoApply

Back it all up so you can diff and restore: Backup-GPO -Name $gpo.DisplayName -Path C:\GPOBackups. And remember a machine only re-reads policy on refresh or reboot, so test with gpupdate /force and gpresult /h out.html.