Solved

Prevent GPO from applying

Posted on 2012-12-28
11
419 Views
Last Modified: 2013-01-08
We have an OU for terminal Servers , we have blocked the inheritances so that no domain GPO apply on this OU.
This OU has all the Servers with terminal Server role installed.
Now we created 3 separate GPO's and applied them to the Terminal Server OU
GPO1 - For Computers
GPO2 - For Users
Q:1 - The gpo created for computers have User Configuration settings disabled
What we setup in this are various server settings for TS and we also enabled a policy named:
Set user profile path for all users logging on to this computer
All was fine until i realized even the administrators who login to these servers get this , which i did not wanted.
So i looked around and found "How to prevent domain Group Policies from applying to certain user or computer accounts"
http://support.microsoft.com/kb/816100
I Added a Group for the users who belong to admin group in the delegation tab in GPMC and followed the steps to deny GPO as mentioned in above article.
I ran Gpupdate /force couple of times
Rebooted servers
But the users who belong to this group still get their profile roaming .
I do not want these policies to be applied to the Admins.
Is there something i am doing wrong.
Is there anyway i can reset all group policies
How soon does a GPO become available after we edited it
does it depend on the replication ? in AD
0
Comment
Question by:MOQINFRA
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 6
  • 4
11 Comments
 
LVL 34

Expert Comment

by:Paul MacDonald
ID: 38726957
So this group is denied permission to have the Policy applied to them?  Are these accounts members of any other groups?
0
 
LVL 37

Expert Comment

by:Neil Russell
ID: 38726997
Are you saying that you do not want the COMPUTER policy settings applied if its an ADMINISTRATIVE USER??
0
 
LVL 37

Expert Comment

by:Neil Russell
ID: 38727017
A computer policy is applied to a COMPUTER and NOT to a user. When a computer policy is applied it knows not who the user is.
0
Online Training Solution

Drastically shorten your training time with WalkMe's advanced online training solution that Guides your trainees to action. Forget about retraining and skyrocket knowledge retention rates.

 

Author Comment

by:MOQINFRA
ID: 38727053
Yes i do not want the Computer policy to apply when a admin logs in
0
 

Author Comment

by:MOQINFRA
ID: 38727056
yes these accounts are member of other groups as well. but shudnt deny override .
0
 
LVL 37

Expert Comment

by:Neil Russell
ID: 38727201
You misunderstand.

A computer policy is applied to THE COMPUTER and NOT to a user therefore you can NOT DENY the policy for computer settings to a user ONLY to a computer.
0
 

Author Comment

by:MOQINFRA
ID: 38727304
So i would i be able to deny this reaming profile for some users and not all . do i have to setup some other policy instead of this one.
0
 
LVL 37

Accepted Solution

by:
Neil Russell earned 500 total points
ID: 38727353
The commenest aproach is to have TS Administratve logins with an empty profile for any admin that needs to access the TS servers.

Do you not already have user accounts AND admin accounts for all your admin users?

i.e.

John.Jones  AND john.jonesAD

Nobody should realy be logging in with an administrative account for just general day to day work unless it absolutely requires admin priveledges.
0
 
LVL 37

Expert Comment

by:Neil Russell
ID: 38727355
"So i would i be able to deny this reaming profile for some users and not all "

NO. by using that policy it does exactly what it says.  ALL USERS, no exceptions.
0
 

Author Comment

by:MOQINFRA
ID: 38727637
Yes we have 2 different accounts

me and me_admin
0
 
LVL 37

Expert Comment

by:Neil Russell
ID: 38756404
Giving a Grade C ? Would you explain why you feel its a grade 'C'?

Grading answers as a 'C' when you have been given the correct information, but you dont like the answer because it proves you cant do what you wanted just discourages experts from helping you in the future.
0

Featured Post

Office 365 Training for IT Pros

Learn how to provision tenants, synchronize on-premise Active Directory, implement Single Sign-On, customize Office deployment, and protect your organization with eDiscovery and DLP policies.  Only from Platform Scholar.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

A project that enables an administrator to perform actions within a user session context not just at the time of login but any time later on day(s) or week(s) later.
A company’s centralized system that manages user data, security, and distributed resources is often a focus of criminal attention. Active Directory (AD) is no exception. In truth, it’s even more likely to be targeted due to the number of companies …
Internet Business Fax to Email Made Easy - With  eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, f…
In this brief tutorial Pawel from AdRem Software explains how you can quickly find out which services are running on your network, or what are the IP addresses of servers responsible for each service. Software used is freeware NetCrunch Tools (https…

695 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question