We help IT Professionals succeed at work.

How can I apply a Group Policy to all users except the administrator and only on specified computers?

593 Views
Last Modified: 2015-10-09
I want to apply a group policy (using a Windows Server 2008 R2 Domain Controller) only to specified computers (either specified by a list of computer names or by specifying all Server 2008 R2 computers) and only for all users that aren't the administrator.  Is this possible?  How can I do this?
Comment
Watch Question

Systems Administrator
Commented:
This one is on us!
(Get your first solution completely free - no credit card required)
UNLOCK SOLUTION

Commented:
You can deploy a policy By either "User" or "Computer" from reading the above i would create the GPO around the computer account. Ensure all computers are either in the same container or you will need to apply the policy at top level. If there are multiple computers you would like this to be applied to then Create a Group and add all computers to the named Group for easy management.

When you have build the policy attach it at the top OU level that encompass all computers you would like to manage and then within GPO manager when you have build the policy within the Scope Tab > Security filtering (at the bottom) add the computer group you created here and the policy to have created will apply to all computers within that group.

Author

Commented:
Thomas -
   Thank you.  That was helpful.  I see how to specify all Server 2008 R2 computers, but how would I specify all users that aren't administrator?

Commented:
so there you would need to follow the instruction set from Thomas around the WMI filtering. It may look daunting but have a read of his Link and this should point you in the right direction. You then may need to build the GPO slightly different but the theory base there is good for you.
Thomas GrassiSystems Administrator

Commented:
Are you asking how to check who in AD is not an administrator?

Or do you need to exclude the administrator?


You can make all no admins a group then use WMI filter to select that group

Author

Commented:
If I put the groups "User List 1" and "Computer List 1" in Security Filtering, will the GPO :

1.) only be applied to a User from "User LIst 1" logging into a computer from "Computer List 1"

or

2.) be applied whenever a user from "User List 1" logs into any computer and whenever any user logs into a computer from "Computer List 1"

or

3.) the computer settings will be applied to any computer in "Computer List 1" and the user settings will be applied to any user in "User List 1"
Thomas GrassiSystems Administrator
Commented:
This one is on us!
(Get your first solution completely free - no credit card required)
UNLOCK SOLUTION

Author

Commented:
That last post was a separate question.  Sorry if that made it confusing.  To answer your question, I want to just exclude the administrator, but don't want to manually create and maintain a group of every user that isn't an administrator.  Is there a way to create a group for "every user but administrator" (i.e. instead of specifying every user that belongs to the group, specify the one user that doesn't belong to the group)?  Or would I do that in a select statement via WMI?
Thomas GrassiSystems Administrator

Commented:
you can just exclude the Administrator using WMI

Look at Domain Users group.

We always keep domain admins administrator separate from the users in the domain

Groups are the best way to do that.

Author

Commented:
administrator is a member of "domain users".  Are you recommending that I delete administrator from this group?  And are you also recommending that any user in the "Domain Admins" group be removed from the "domain users" group?

What would the WMI select statement be to select all users but administrator?

Also, I only want to apply *user settings* to Server 2008  computers (and only if the user isn't administrator).  If user filtering is for user setting and computer filtering is for computer settings, I still don't understand how I could make this work.  Is it possible?
Thomas GrassiSystems Administrator

Commented:
try something like this

Select * FROM Win32_ComputerSystem WHERE UserName <> "domainName\UserName"


Also no do not remove those users from the default groups
Best to create a new group and put all non admins in that group

HTH
Will SzymkowskiSenior Solution Architect
CERTIFIED EXPERT
Most Valuable Expert 2015
Top Expert 2015

Commented:
WMI Filters are not the most simplistic approach here. They also slow down the logon process as well as it has to query against machines to see if it matches the query.

Your best bet would be to create a Security Group -> add all of your computers to this new group -> set the security filtering on the GPO to point to the new group -> link the GPO to whatever OU's the computers are in

If they are in multiple different OU's then link it once at the domain level.

Thats it.

Will.

Author

Commented:
Thanks for the information.

Gain unlimited access to on-demand training courses with an Experts Exchange subscription.

Get Access
Why Experts Exchange?

Experts Exchange always has the answer, or at the least points me in the correct direction! It is like having another employee that is extremely experienced.

Jim Murphy
Programmer at Smart IT Solutions

When asked, what has been your best career decision?

Deciding to stick with EE.

Mohamed Asif
Technical Department Head

Being involved with EE helped me to grow personally and professionally.

Carl Webster
CTP, Sr Infrastructure Consultant
Empower Your Career
Did You Know?

We've partnered with two important charities to provide clean water and computer science education to those who need it most. READ MORE

Ask ANY Question

Connect with Certified Experts to gain insight and support on specific technology challenges including:

  • Troubleshooting
  • Research
  • Professional Opinions
Unlock the solution to this question.
Join our community and discover your potential

Experts Exchange is the only place where you can interact directly with leading experts in the technology field. Become a member today and access the collective knowledge of thousands of technology experts.

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

OR

Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.