Microsoft Knowledge Base Article 324750 contains the following summary:
You (as an administrator) can use group policies to assign
or publish software to users or computers in a domain,
and it is useful to be
able to deploy software based on group membership.
Group Policy Objects (GPOs)
are typically applied only to members of organizational units to which the GPO
is
linked.
Because users cannot be
located in several organization units at one
time,
you must be able to apply group policies outside the boundaries of
organization units.
This article describes how to apply your software
deployment policy to users who are outside the boundaries of organization
units.