Solved

Prevent GPO from applying

Posted on 2012-12-28
11
415 Views
Last Modified: 2013-01-08
We have an OU for terminal Servers , we have blocked the inheritances so that no domain GPO apply on this OU.
This OU has all the Servers with terminal Server role installed.
Now we created 3 separate GPO's and applied them to the Terminal Server OU
GPO1 - For Computers
GPO2 - For Users
Q:1 - The gpo created for computers have User Configuration settings disabled
What we setup in this are various server settings for TS and we also enabled a policy named:
Set user profile path for all users logging on to this computer
All was fine until i realized even the administrators who login to these servers get this , which i did not wanted.
So i looked around and found "How to prevent domain Group Policies from applying to certain user or computer accounts"
http://support.microsoft.com/kb/816100
I Added a Group for the users who belong to admin group in the delegation tab in GPMC and followed the steps to deny GPO as mentioned in above article.
I ran Gpupdate /force couple of times
Rebooted servers
But the users who belong to this group still get their profile roaming .
I do not want these policies to be applied to the Admins.
Is there something i am doing wrong.
Is there anyway i can reset all group policies
How soon does a GPO become available after we edited it
does it depend on the replication ? in AD
0
Comment
Question by:MOQINFRA
  • 6
  • 4
11 Comments
 
LVL 34

Expert Comment

by:Paul MacDonald
ID: 38726957
So this group is denied permission to have the Policy applied to them?  Are these accounts members of any other groups?
0
 
LVL 37

Expert Comment

by:Neil Russell
ID: 38726997
Are you saying that you do not want the COMPUTER policy settings applied if its an ADMINISTRATIVE USER??
0
 
LVL 37

Expert Comment

by:Neil Russell
ID: 38727017
A computer policy is applied to a COMPUTER and NOT to a user. When a computer policy is applied it knows not who the user is.
0
Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

 

Author Comment

by:MOQINFRA
ID: 38727053
Yes i do not want the Computer policy to apply when a admin logs in
0
 

Author Comment

by:MOQINFRA
ID: 38727056
yes these accounts are member of other groups as well. but shudnt deny override .
0
 
LVL 37

Expert Comment

by:Neil Russell
ID: 38727201
You misunderstand.

A computer policy is applied to THE COMPUTER and NOT to a user therefore you can NOT DENY the policy for computer settings to a user ONLY to a computer.
0
 

Author Comment

by:MOQINFRA
ID: 38727304
So i would i be able to deny this reaming profile for some users and not all . do i have to setup some other policy instead of this one.
0
 
LVL 37

Accepted Solution

by:
Neil Russell earned 500 total points
ID: 38727353
The commenest aproach is to have TS Administratve logins with an empty profile for any admin that needs to access the TS servers.

Do you not already have user accounts AND admin accounts for all your admin users?

i.e.

John.Jones  AND john.jonesAD

Nobody should realy be logging in with an administrative account for just general day to day work unless it absolutely requires admin priveledges.
0
 
LVL 37

Expert Comment

by:Neil Russell
ID: 38727355
"So i would i be able to deny this reaming profile for some users and not all "

NO. by using that policy it does exactly what it says.  ALL USERS, no exceptions.
0
 

Author Comment

by:MOQINFRA
ID: 38727637
Yes we have 2 different accounts

me and me_admin
0
 
LVL 37

Expert Comment

by:Neil Russell
ID: 38756404
Giving a Grade C ? Would you explain why you feel its a grade 'C'?

Grading answers as a 'C' when you have been given the correct information, but you dont like the answer because it proves you cant do what you wanted just discourages experts from helping you in the future.
0

Featured Post

Microsoft Certification Exam 74-409

Veeam® is happy to provide the Microsoft community with a study guide prepared by MVP and MCT, Orin Thomas. This guide will take you through each of the exam objectives, helping you to prepare for and pass the examination.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

In this article, we will see the basic design consideration while designing a Multi-tenant web application in a simple manner. Though, many frameworks are available in the market to develop a multi - tenant application, but do they provide data, cod…
This article runs through the process of deploying a single EXE application selectively to a group of user.
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…

821 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question