Using a security group to deny access to default domain policy

Posted on 2006-03-31
Last Modified: 2012-05-05
I have automatic updates configured in our default domain policy and i'd like to exclude our production servers from it.  I set up a security group and added all the computer accounts for the servers I want excluded.  Then I added that security group to the group policy and checked deny apply policy.  When I doa gpupdate and gpresult it still shows that it's applying the default domain policy.  on the other hand, if I add just a single machine account to the ACL of the default domain policy and check the deny apply group policy it works as expected.  when I run gpresult it shows that it's been blocked by the ACL.  

Why won't this work with a security group containing the machine accounts?
Question by:shanna1017
    LVL 19

    Accepted Solution

    Hi shanna1017,

    Group policies are applied to OUs and only affect Computer or User objects within the OU (or a child OU) - They are not applied to Security or Distro Groups.

    You should create a seperate OU for your production servers to be placed in and then block inheritance of the default GPO to that OU.


    Author Comment

    I'm not trying to apply a group policy to a security group, I'm trying to filter based on a security group.  I thought that was allowed.  

    I will give your suggestion a try.
    LVL 48

    Expert Comment

    Hi shanna1017,

    you can use security filtering based on security groups as long as the groups is under the same OU


    Featured Post

    Better Security Awareness With Threat Intelligence

    See how one of the leading financial services organizations uses Recorded Future as part of a holistic threat intelligence program to promote security awareness and proactively and efficiently identify threats.

    Join & Write a Comment

    Many of us need to configure DHCP server(s) in their environment. We can do that simply via DHCP console on server or using MMC snap-in on each computer with Administrative Tools installed in a network. But what if we have to configure many DHCP ser…
    A quick step-by-step overview of installing and configuring Carbonite Server Backup.
    In this seventh video of the Xpdf series, we discuss and demonstrate the PDFfonts utility, which lists all the fonts used in a PDF file. It does this via a command line interface, making it suitable for use in programs, scripts, batch files — any pl…
    In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor ( If you're interested in additional methods for monitoring bandwidt…

    746 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    18 Experts available now in Live!

    Get 1:1 Help Now