Exempt one machine certain rules from Windows 2003 group policy

Have you set this for the user or computer.  Either way you can put the machine in a different OU which has the policy blocked (unless you set no block which overrides that) or add the computer to the security of that GPO and give it Deny against Apply Group Policy.

Steve

Hi,

Thanks for your reply. I have set this rule for the user, rather than computer. I still require this machine to apply every other rule in the group policy, I just want this single machine to be exempt from that one rule, but still apply all the others.

Thanks again.

Ad

You'll have to get into loopback processing to do that I believe -- you are applying policy to all users but one one machine not to get it.  If this was excluding one machine from a machine policy or one user from a user policy would suggest splitting the particular settings of into a different GPO or assinging one reversing the settings on the user/machne's OU

I haven't used this much and don't have access at the moment to describe the process for you.  Someone else will no doubt in a minute, otherwise will look again later.

Steve

Create 2 OU's in active directory
Place all the systems you want the policy applied to in one OU, and the the one you don't want the policy applied to in the other

Move the group policies to the appropriet OUs (you can have the same GP applied to both OUs and just have the screen saver GP applied to the one).

If you leave the GP at the domain level, it dosen't matter what OU you put the computer in, it will get the GP.

eb

My point here was he wanted it applied to users and to not apply to one machine.  That has to involve loopback processing surely?

If you want it applied to users, then put the users in the OU and apply the GP to that.  No need to mess with loopback

But he wants it to NOT apply to just one, presuambly regardless of which user logs in...

Here goes:
http://support.microsoft.com/kb/231287

"1. In the Group Policy Microsoft Management Console (MMC), click Computer Configuration.
2. Locate Administrative Templates, click System, click Group Policy, and then enable the Loopback Policy option "

Then if you apply the GP to an OU with computes in it, and yes you can set the GP in the user section, any user that logs into a computer in the OU with the GP will get the GP.

eb

Thanks for the answer.  Why the B grade?