Deny access to apply a GPO

server 2003

i may have misunderstood how 1 can stop gpo applying particular user.  example, have gpos set admin cannot 'apply group policy' in delegation settings.

now, have gpos linked computer/server ous.

so, assumed if have servera in ou gpo has computer , user settings, because admin denied access apply group policy, none of computer settings apply admin's session.

for example, in particular "do not allow drive redirection", computer setting.  hoping apply gpo servera, regular users denied "bring in" drives rdp sessions, not apply admin.

unfortunately, theory doesn't seem work, , if set gpo "do not allow drive redirection" enabled, admin cannot bring in local drives on rdp.

 

acling user not impact computer configuration settings being applied (you need change acl computer account not have apply group policy right...a specific deny "apply group policy"), discovered. user configuration portion not apply in scenario provided (it should access denied if looking @ gpresult /z), overwritten using loopback policy, situation, sounds won't ticket (loopback can used user settings).

one easy solution create sandbox ou move computer objects prior techs working on system eliminate group policy concerns. has caveat of restart of machine being needed, or running gpupdate /force (which may still need restart take effect). recommend client side though, , not servers.

 

the easiest solution: have admin map drives via \\server\drive$ access

---

brandon wilson - premier field engineer (platforms)

Windows Server  >  Group Policy