Link to home
Start Free TrialLog in
Avatar of MOQINFRA
MOQINFRA

asked on

Prevent GPO from applying

We have an OU for terminal Servers , we have blocked the inheritances so that no domain GPO apply on this OU.
This OU has all the Servers with terminal Server role installed.
Now we created 3 separate GPO's and applied them to the Terminal Server OU
GPO1 - For Computers
GPO2 - For Users
Q:1 - The gpo created for computers have User Configuration settings disabled
What we setup in this are various server settings for TS and we also enabled a policy named:
Set user profile path for all users logging on to this computer
All was fine until i realized even the administrators who login to these servers get this , which i did not wanted.
So i looked around and found "How to prevent domain Group Policies from applying to certain user or computer accounts"
http://support.microsoft.com/kb/816100
I Added a Group for the users who belong to admin group in the delegation tab in GPMC and followed the steps to deny GPO as mentioned in above article.
I ran Gpupdate /force couple of times
Rebooted servers
But the users who belong to this group still get their profile roaming .
I do not want these policies to be applied to the Admins.
Is there something i am doing wrong.
Is there anyway i can reset all group policies
How soon does a GPO become available after we edited it
does it depend on the replication ? in AD
Avatar of Paul MacDonald
Paul MacDonald
Flag of United States of America image

So this group is denied permission to have the Policy applied to them?  Are these accounts members of any other groups?
Are you saying that you do not want the COMPUTER policy settings applied if its an ADMINISTRATIVE USER??
A computer policy is applied to a COMPUTER and NOT to a user. When a computer policy is applied it knows not who the user is.
Avatar of MOQINFRA
MOQINFRA

ASKER

Yes i do not want the Computer policy to apply when a admin logs in
yes these accounts are member of other groups as well. but shudnt deny override .
You misunderstand.

A computer policy is applied to THE COMPUTER and NOT to a user therefore you can NOT DENY the policy for computer settings to a user ONLY to a computer.
So i would i be able to deny this reaming profile for some users and not all . do i have to setup some other policy instead of this one.
ASKER CERTIFIED SOLUTION
Avatar of Neil Russell
Neil Russell
Flag of United Kingdom of Great Britain and Northern Ireland image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
"So i would i be able to deny this reaming profile for some users and not all "

NO. by using that policy it does exactly what it says.  ALL USERS, no exceptions.
Yes we have 2 different accounts

me and me_admin
Giving a Grade C ? Would you explain why you feel its a grade 'C'?

Grading answers as a 'C' when you have been given the correct information, but you dont like the answer because it proves you cant do what you wanted just discourages experts from helping you in the future.