Hello All,
I'm having some difficulty with my GPO design. I have the following OU's:
Company Users (with a "Users Policy" GPO)
Company Computers (with a "Computers Policy" GPO)
All Users (except Domain Admins - I'm leaving them in the default Users container) go into the Company Users OU, and all Computers go into the Company Computers OU. My goal was to apply a GPO that only had the "User configuration" settings enabled for the Users OU, and a seperate GPO with only the "Computer Configuration" settings enabled for the Computers OU. It is suggested by MS to break out the computers/users into separate OU's, and it seems to make sense to me. I have found problems (and confusion) with this approach, and I need some guidance.
Problem #1 - I realized that any computer configuration settings that I set up would apply to ALL users of those client computers, even domain admins. This is obviously a problem because when my Domain Admins log onto a client machine, I don't want them to have any restrictions. I can't find much online about this, so I figure I am probably doing something wrong from a basic design standpoint. There are a few workarounds I've found (ie explicitly DENY the domain admins group from the "Company Computers" GPO, or create another GPO that explicitly allows these settings and have it take precendence), but this doesn't seem like a clean setup. And I feel like I'm missing something here. Seems like a weird design.
Problem #2 - While looking through the GPO settings, I noticed several duplicate settings between Computer Configuration and User Configuration. Why is that? Why would any of the Administrative Template settings like "User Profiles" or "Logon" be located in the Computer Configuration? It makes no sense to me. Seems like the Computer Configuration portion should be for things like services, while the User Configuration portion should be for things like application permissions.
Problem #3 - There are some settings in Computer Configuration that aren't in User Configuration, so I won't be able to use them at all unless I apply them to ALL computers in the domain, and hence the Domain Admins as well.
Can someone shed some light on this for me? I would realy appreciate it!
Start Free Trial
