Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 491
  • Last Modified:

Move a user to a new OU and block the GPO of the OU so it is not applied to the user move Windows 2008 Active Directory

I want to move a user to a new OU but want to block the GPO that is applied to the OU on this one user. How do I block an OU's GPO from being applied to a single user in the OU?
0
lanman777
Asked:
lanman777
1 Solution
 
TAWpowerCommented:
You would have to create a different OU for that user. You cannot block on a user just an OU. This is in keeping with best practices for GPOs.

Hope this helps.
0
 
mnation1Commented:
You'll have to create an OU inside of that one to do this.  Then create a new policy for the sub-OU and check the box to "block policy inheritance".

-mitch
0
 
thomasd04Commented:
Hi Ian. GPOs have access control lists (ACLs) associated with them. This means you can use Security Filtering on the GPO to apply it to specific users or groups. Check here: http://www.windowsnetworking.com/articles_tutorials/Group-Policy-Security-Filtering.html
0
 
MarkieSCommented:
You can also make use of WMI filtering similar to "thomasd04" suggestion.

Security and WMI filtering can provide a good granularity of targeting Group Policies

To do this with WMI filtering
Group Policy Management console - go to WMI filters
Create a filter and Edit it

   SELECT * FROM Win32_UserAccount where FullName <> "YourUserName"

Then apply this filter to your relevant Group policy

The Group Policy will be applied to everyone in the OU that is not "YourUserName"

cheers
Mark S
0

Featured Post

Keep up with what's happening at Experts Exchange!

Sign up to receive Decoded, a new monthly digest with product updates, feature release info, continuing education opportunities, and more.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now