Solved

Security groups for GPOs

Posted on 2004-09-11
1
360 Views
Last Modified: 2012-05-05
When we create organizational units and I want to apply GPOs to objects contained in them (for example users or computers), I have realized that if we do not want to apply the policy to special users (Help desk users, admistrators, etc) when they log in that computers (to complete maintenance tasks) it is necessary to use GPO filtering to avoid it.  that force to create a group with same objects that are contained in that OU to  APPLY and READ checkboxes only for that group. We remove authenticated users of the list. In that way when an IT user log in he has not problem with the computer. I don´t understand very well this. We have to create the same groups with the users or computer which are incluided in the container? . Is that correct ?. Is it a good idea and practice to deny APPLY and READ GPOs for these special groups of administrators ?




0
Comment
Question by:intentalo69
1 Comment
 
LVL 83

Accepted Solution

by:
oBdA earned 250 total points
ID: 12035146
In my opinion, your approach is correct; I don't like the "Deny" approach, neither for NTFS nor for GPOs. What I usually do is to gather the GPOs in a top-level OU, then create a dedicated security group for each GPO, named something like GPol-<GPOName>; the Read and Apply permissions are removed from the Authenticated Users, and applied to the group instead. That way, you can easily find your GPOs, instead of having to search for them in several different OUs, and you have easy control about who gets which policies applied. If you combine that with the GPO priority, you can avoid duplicate settings in different GPOs, depending on your needs.
In addition, I separate the computer and user settings in different GPOs; you can then disable the User configuration part of the GPO in machine GPOs, and vice versa.
Whether that approach works for you depends of course on your organisation, and if you want to delegate control over OUs to other users, and the air humidity.
Another good idea is the use of the Group Policy Management Console; that makes the administration a bit easier.
Enterprise Management with the Group Policy Management Console
http://www.microsoft.com/windowsserver2003/gpmc/default.mspx
0

Featured Post

Complete VMware vSphere® ESX(i) & Hyper-V Backup

Capture your entire system, including the host, with patented disk imaging integrated with VMware VADP / Microsoft VSS and RCT. RTOs is as low as 15 seconds with Acronis Active Restore™. You can enjoy unlimited P2V/V2V migrations from any source (even from a different hypervisor)

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Numerous times I have been asked this questions that what is it that makes my machine log on so slow, there have been cases where computers took 23 minute exactly after taking password and getting to the desktop. Interesting thing was the fact th…
Restoring deleted objects in Active Directory has been a standard feature in Active Directory for many years, yet some admins may not know what is available.
This tutorial gives a high-level tour of the interface of Marketo (a marketing automation tool to help businesses track and engage prospective customers and drive them to purchase). You will see the main areas including Marketing Activities, Design …
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …

786 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question