How can I apply a Group Policy to all users except the administrator and only on specified computers?
I want to apply a group policy (using a Windows Server 2008 R2 Domain Controller) only to specified computers (either specified by a list of computer names or by specifying all Server 2008 R2 computers) and only for all users that aren't the administrator. Is this possible? How can I do this?
You can deploy a policy By either "User" or "Computer" from reading the above i would create the GPO around the computer account. Ensure all computers are either in the same container or you will need to apply the policy at top level. If there are multiple computers you would like this to be applied to then Create a Group and add all computers to the named Group for easy management.
When you have build the policy attach it at the top OU level that encompass all computers you would like to manage and then within GPO manager when you have build the policy within the Scope Tab > Security filtering (at the bottom) add the computer group you created here and the policy to have created will apply to all computers within that group.
Declan Basile
ASKER
Thomas -
Thank you. That was helpful. I see how to specify all Server 2008 R2 computers, but how would I specify all users that aren't administrator?
ncomper
so there you would need to follow the instruction set from Thomas around the WMI filtering. It may look daunting but have a read of his Link and this should point you in the right direction. You then may need to build the GPO slightly different but the theory base there is good for you.
That last post was a separate question. Sorry if that made it confusing. To answer your question, I want to just exclude the administrator, but don't want to manually create and maintain a group of every user that isn't an administrator. Is there a way to create a group for "every user but administrator" (i.e. instead of specifying every user that belongs to the group, specify the one user that doesn't belong to the group)? Or would I do that in a select statement via WMI?
We always keep domain admins administrator separate from the users in the domain
Groups are the best way to do that.
Declan Basile
ASKER
administrator is a member of "domain users". Are you recommending that I delete administrator from this group? And are you also recommending that any user in the "Domain Admins" group be removed from the "domain users" group?
What would the WMI select statement be to select all users but administrator?
Also, I only want to apply *user settings* to Server 2008 computers (and only if the user isn't administrator). If user filtering is for user setting and computer filtering is for computer settings, I still don't understand how I could make this work. Is it possible?
Member_2_6492660_1
try something like this
Select * FROM Win32_ComputerSystem WHERE UserName <> "domainName\UserName"
Also no do not remove those users from the default groups
Best to create a new group and put all non admins in that group
WMI Filters are not the most simplistic approach here. They also slow down the logon process as well as it has to query against machines to see if it matches the query.
Your best bet would be to create a Security Group -> add all of your computers to this new group -> set the security filtering on the GPO to point to the new group -> link the GPO to whatever OU's the computers are in
If they are in multiple different OU's then link it once at the domain level.
When you have build the policy attach it at the top OU level that encompass all computers you would like to manage and then within GPO manager when you have build the policy within the Scope Tab > Security filtering (at the bottom) add the computer group you created here and the policy to have created will apply to all computers within that group.