• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 429
  • Last Modified:

Prevent GPO from applying

We have an OU for terminal Servers , we have blocked the inheritances so that no domain GPO apply on this OU.
This OU has all the Servers with terminal Server role installed.
Now we created 3 separate GPO's and applied them to the Terminal Server OU
GPO1 - For Computers
GPO2 - For Users
Q:1 - The gpo created for computers have User Configuration settings disabled
What we setup in this are various server settings for TS and we also enabled a policy named:
Set user profile path for all users logging on to this computer
All was fine until i realized even the administrators who login to these servers get this , which i did not wanted.
So i looked around and found "How to prevent domain Group Policies from applying to certain user or computer accounts"
http://support.microsoft.com/kb/816100
I Added a Group for the users who belong to admin group in the delegation tab in GPMC and followed the steps to deny GPO as mentioned in above article.
I ran Gpupdate /force couple of times
Rebooted servers
But the users who belong to this group still get their profile roaming .
I do not want these policies to be applied to the Admins.
Is there something i am doing wrong.
Is there anyway i can reset all group policies
How soon does a GPO become available after we edited it
does it depend on the replication ? in AD
0
MOQINFRA
Asked:
MOQINFRA
  • 6
  • 4
1 Solution
 
Paul MacDonaldDirector, Information SystemsCommented:
So this group is denied permission to have the Policy applied to them?  Are these accounts members of any other groups?
0
 
Neil RussellTechnical Development LeadCommented:
Are you saying that you do not want the COMPUTER policy settings applied if its an ADMINISTRATIVE USER??
0
 
Neil RussellTechnical Development LeadCommented:
A computer policy is applied to a COMPUTER and NOT to a user. When a computer policy is applied it knows not who the user is.
0
Improve Your Query Performance Tuning

In this FREE six-day email course, you'll learn from Janis Griffin, Database Performance Evangelist. She'll teach 12 steps that you can use to optimize your queries as much as possible and see measurable results in your work. Get started today!

 
MOQINFRAAuthor Commented:
Yes i do not want the Computer policy to apply when a admin logs in
0
 
MOQINFRAAuthor Commented:
yes these accounts are member of other groups as well. but shudnt deny override .
0
 
Neil RussellTechnical Development LeadCommented:
You misunderstand.

A computer policy is applied to THE COMPUTER and NOT to a user therefore you can NOT DENY the policy for computer settings to a user ONLY to a computer.
0
 
MOQINFRAAuthor Commented:
So i would i be able to deny this reaming profile for some users and not all . do i have to setup some other policy instead of this one.
0
 
Neil RussellTechnical Development LeadCommented:
The commenest aproach is to have TS Administratve logins with an empty profile for any admin that needs to access the TS servers.

Do you not already have user accounts AND admin accounts for all your admin users?

i.e.

John.Jones  AND john.jonesAD

Nobody should realy be logging in with an administrative account for just general day to day work unless it absolutely requires admin priveledges.
0
 
Neil RussellTechnical Development LeadCommented:
"So i would i be able to deny this reaming profile for some users and not all "

NO. by using that policy it does exactly what it says.  ALL USERS, no exceptions.
0
 
MOQINFRAAuthor Commented:
Yes we have 2 different accounts

me and me_admin
0
 
Neil RussellTechnical Development LeadCommented:
Giving a Grade C ? Would you explain why you feel its a grade 'C'?

Grading answers as a 'C' when you have been given the correct information, but you dont like the answer because it proves you cant do what you wanted just discourages experts from helping you in the future.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Improve Your Query Performance Tuning

In this FREE six-day email course, you'll learn from Janis Griffin, Database Performance Evangelist. She'll teach 12 steps that you can use to optimize your queries as much as possible and see measurable results in your work. Get started today!

  • 6
  • 4
Tackle projects and never again get stuck behind a technical roadblock.
Join Now