Prevent GPO from applying

MOQINFRA
MOQINFRA used Ask the Experts™
on
We have an OU for terminal Servers , we have blocked the inheritances so that no domain GPO apply on this OU.
This OU has all the Servers with terminal Server role installed.
Now we created 3 separate GPO's and applied them to the Terminal Server OU
GPO1 - For Computers
GPO2 - For Users
Q:1 - The gpo created for computers have User Configuration settings disabled
What we setup in this are various server settings for TS and we also enabled a policy named:
Set user profile path for all users logging on to this computer
All was fine until i realized even the administrators who login to these servers get this , which i did not wanted.
So i looked around and found "How to prevent domain Group Policies from applying to certain user or computer accounts"
http://support.microsoft.com/kb/816100
I Added a Group for the users who belong to admin group in the delegation tab in GPMC and followed the steps to deny GPO as mentioned in above article.
I ran Gpupdate /force couple of times
Rebooted servers
But the users who belong to this group still get their profile roaming .
I do not want these policies to be applied to the Admins.
Is there something i am doing wrong.
Is there anyway i can reset all group policies
How soon does a GPO become available after we edited it
does it depend on the replication ? in AD
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Paul MacDonaldDirector, Information Systems

Commented:
So this group is denied permission to have the Policy applied to them?  Are these accounts members of any other groups?
Neil RussellTechnical Development Lead

Commented:
Are you saying that you do not want the COMPUTER policy settings applied if its an ADMINISTRATIVE USER??
Neil RussellTechnical Development Lead

Commented:
A computer policy is applied to a COMPUTER and NOT to a user. When a computer policy is applied it knows not who the user is.
Success in ‘20 With a Profitable Pricing Strategy

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden using our free interactive tool and use it to determine the right price for your IT services. Start calculating Now!

Author

Commented:
Yes i do not want the Computer policy to apply when a admin logs in

Author

Commented:
yes these accounts are member of other groups as well. but shudnt deny override .
Neil RussellTechnical Development Lead

Commented:
You misunderstand.

A computer policy is applied to THE COMPUTER and NOT to a user therefore you can NOT DENY the policy for computer settings to a user ONLY to a computer.

Author

Commented:
So i would i be able to deny this reaming profile for some users and not all . do i have to setup some other policy instead of this one.
Technical Development Lead
Commented:
The commenest aproach is to have TS Administratve logins with an empty profile for any admin that needs to access the TS servers.

Do you not already have user accounts AND admin accounts for all your admin users?

i.e.

John.Jones  AND john.jonesAD

Nobody should realy be logging in with an administrative account for just general day to day work unless it absolutely requires admin priveledges.
Neil RussellTechnical Development Lead

Commented:
"So i would i be able to deny this reaming profile for some users and not all "

NO. by using that policy it does exactly what it says.  ALL USERS, no exceptions.

Author

Commented:
Yes we have 2 different accounts

me and me_admin
Neil RussellTechnical Development Lead

Commented:
Giving a Grade C ? Would you explain why you feel its a grade 'C'?

Grading answers as a 'C' when you have been given the correct information, but you dont like the answer because it proves you cant do what you wanted just discourages experts from helping you in the future.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial