We help IT Professionals succeed at work.

We've partnered with Certified Experts, Carl Webster and Richard Faulkner, to bring you a podcast all about Citrix Workspace, moving to the cloud, and analytics & intelligence. Episode 2 coming soon!Listen Now


Using a security group to deny access to default domain policy

shanna1017 asked
Medium Priority
Last Modified: 2012-05-05
I have automatic updates configured in our default domain policy and i'd like to exclude our production servers from it.  I set up a security group and added all the computer accounts for the servers I want excluded.  Then I added that security group to the group policy and checked deny apply policy.  When I doa gpupdate and gpresult it still shows that it's applying the default domain policy.  on the other hand, if I add just a single machine account to the ACL of the default domain policy and check the deny apply group policy it works as expected.  when I run gpresult it shows that it's been blocked by the ACL.  

Why won't this work with a security group containing the machine accounts?
Watch Question

Hi shanna1017,

Group policies are applied to OUs and only affect Computer or User objects within the OU (or a child OU) - They are not applied to Security or Distro Groups.

You should create a seperate OU for your production servers to be placed in and then block inheritance of the default GPO to that OU.


Not the solution you were looking for? Getting a personalized solution is easy.

Ask the Experts


I'm not trying to apply a group policy to a security group, I'm trying to filter based on a security group.  I thought that was allowed.  

I will give your suggestion a try.
Top Expert 2006

Hi shanna1017,

you can use security filtering based on security groups as long as the groups is under the same OU


Access more of Experts Exchange with a free account
Thanks for using Experts Exchange.

Create a free account to continue.

Limited access with a free account allows you to:

  • View three pieces of content (articles, solutions, posts, and videos)
  • Ask the experts questions (counted toward content limit)
  • Customize your dashboard and profile

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.


Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.