Avatar of Declan Basile
Declan Basile
Flag for United States of America asked on

How can I apply a Group Policy to all users except the administrator and only on specified computers?

I want to apply a group policy (using a Windows Server 2008 R2 Domain Controller) only to specified computers (either specified by a list of computer names or by specifying all Server 2008 R2 computers) and only for all users that aren't the administrator.  Is this possible?  How can I do this?
Active DirectoryWindows Server 2008

Avatar of undefined
Last Comment
Declan Basile

8/22/2022 - Mon
ASKER CERTIFIED SOLUTION
Member_2_6492660_1

THIS SOLUTION ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
See Pricing Options
Start Free Trial
GET A PERSONALIZED SOLUTION
Ask your own question & get feedback from real experts
Find out why thousands trust the EE community with their toughest problems.
ncomper

You can deploy a policy By either "User" or "Computer" from reading the above i would create the GPO around the computer account. Ensure all computers are either in the same container or you will need to apply the policy at top level. If there are multiple computers you would like this to be applied to then Create a Group and add all computers to the named Group for easy management.

When you have build the policy attach it at the top OU level that encompass all computers you would like to manage and then within GPO manager when you have build the policy within the Scope Tab > Security filtering (at the bottom) add the computer group you created here and the policy to have created will apply to all computers within that group.
Declan Basile

ASKER
Thomas -
   Thank you.  That was helpful.  I see how to specify all Server 2008 R2 computers, but how would I specify all users that aren't administrator?
ncomper

so there you would need to follow the instruction set from Thomas around the WMI filtering. It may look daunting but have a read of his Link and this should point you in the right direction. You then may need to build the GPO slightly different but the theory base there is good for you.
Experts Exchange has (a) saved my job multiple times, (b) saved me hours, days, and even weeks of work, and often (c) makes me look like a superhero! This place is MAGIC!
Walt Forbes
Member_2_6492660_1

Are you asking how to check who in AD is not an administrator?

Or do you need to exclude the administrator?


You can make all no admins a group then use WMI filter to select that group
Declan Basile

ASKER
If I put the groups "User List 1" and "Computer List 1" in Security Filtering, will the GPO :

1.) only be applied to a User from "User LIst 1" logging into a computer from "Computer List 1"

or

2.) be applied whenever a user from "User List 1" logs into any computer and whenever any user logs into a computer from "Computer List 1"

or

3.) the computer settings will be applied to any computer in "Computer List 1" and the user settings will be applied to any user in "User List 1"
SOLUTION
Member_2_6492660_1

THIS SOLUTION ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
See Pricing Options
Start Free Trial
GET A PERSONALIZED SOLUTION
Ask your own question & get feedback from real experts
Find out why thousands trust the EE community with their toughest problems.
Declan Basile

ASKER
That last post was a separate question.  Sorry if that made it confusing.  To answer your question, I want to just exclude the administrator, but don't want to manually create and maintain a group of every user that isn't an administrator.  Is there a way to create a group for "every user but administrator" (i.e. instead of specifying every user that belongs to the group, specify the one user that doesn't belong to the group)?  Or would I do that in a select statement via WMI?
⚡ FREE TRIAL OFFER
Try out a week of full access for free.
Find out why thousands trust the EE community with their toughest problems.
Member_2_6492660_1

you can just exclude the Administrator using WMI

Look at Domain Users group.

We always keep domain admins administrator separate from the users in the domain

Groups are the best way to do that.
Declan Basile

ASKER
administrator is a member of "domain users".  Are you recommending that I delete administrator from this group?  And are you also recommending that any user in the "Domain Admins" group be removed from the "domain users" group?

What would the WMI select statement be to select all users but administrator?

Also, I only want to apply *user settings* to Server 2008  computers (and only if the user isn't administrator).  If user filtering is for user setting and computer filtering is for computer settings, I still don't understand how I could make this work.  Is it possible?
Member_2_6492660_1

try something like this

Select * FROM Win32_ComputerSystem WHERE UserName <> "domainName\UserName"


Also no do not remove those users from the default groups
Best to create a new group and put all non admins in that group

HTH
Experts Exchange is like having an extremely knowledgeable team sitting and waiting for your call. Couldn't do my job half as well as I do without it!
James Murphy
Will Szymkowski

WMI Filters are not the most simplistic approach here. They also slow down the logon process as well as it has to query against machines to see if it matches the query.

Your best bet would be to create a Security Group -> add all of your computers to this new group -> set the security filtering on the GPO to point to the new group -> link the GPO to whatever OU's the computers are in

If they are in multiple different OU's then link it once at the domain level.

Thats it.

Will.
Declan Basile

ASKER
Thanks for the information.