Re: Publishing/Assigning Applications

From: Ken B (none_at_microsoft.com)
Date: 09/20/04 

Date: Mon, 20 Sep 2004 10:49:40 -0400

I think where you erred was in creating the software policy right below the
default domain policy. If I'm getting this right, you applied the software
to the entire domain.

If you want to selectively install the software, you can do so by creating
an OU (right click the domain in Users & Computers and go New>Organizational
Unit), name it. Drop the actual computer object in said OU (not a security
group as GPO's don't apply to security groups, only actual objects). Create
your software policy AT that OU level by right clicking the OU, and creating
the policy. From there, the computer will be within the scope of influence,
and the computer will receive the policy. If you want to remove the
'package' when the computer leaves the scope of influence, click the box.
The software will be (should at least) removed when you move the computer
object out of that OU.

You CAN use security groups to filter the GPO's within an OU.... say you
have an OU for "All of Our Computers" and placed all of the computer objects
in there. Apply a software package for say Office 2003 to it. You don't
want the Accounting department to get the package yet. Make a security group
with Accounting's computers in it, then go to the security tab on the GPO
object, add Accounting_Computers (or whatever you named the security group)
and give them DENY permissions. That's the only way that security groups
would function with GPO's--security/distribution groups don't fall within
the scope of influence.

Good luck... post back if you have questions---

Ken

"CurtisC" <CurtisC@discussions.microsoft.com> wrote in message
news:BA297112-6252-45E9-A7EA-7A4CE769D3FE@microsoft.com...
> I am at an impass. I have done the following.
>
> Created a Network Sharepoint
> Ran and Administrative Setup of an application and placed it there.
> Created a security group and placed an XP computer in it.
> Created a new group policy below the default policy
> Under computer setup to assign an application and placed the security
group
> in it.
> Rebooted XP computer and watched the application being installed on it.
>
> Now here is my issue. I want the abilty to remove the application by
> removing the computer from the security group, but it does not work. I
have
> the box checked to remove application if it falls out of scope, but when I
> remove the computer it does not remove the applicaiton. If I delete the
> entire security group it does remove the application from the workstation,
> but if I do that then I remove it from more then one computer..
>
> Any help would be appreciated.
>
> Thanks

Relevant Pages

  • Re: Publishing/Assigning Applications
    ... > default domain policy. ... > 'package' when the computer leaves the scope of influence, ... add Accounting_Computers (or whatever you named the security group) ...
    (microsoft.public.win2000.group_policy)
  • Re: GPO testing
    ... Here are the steps I used to create and link the GPO: ... Placed two users in the security group Test Group. ... Right clicked on the new policy called "test" and selected edit. ... Test Group on my XP workstation. ...
    (microsoft.public.windows.group_policy)
  • Re: Creating Additional SMTP emails in Exchange
    ... Instead I added the users to the Security Group Domain B ... first and then apply the policy. ... Primary SMTP as well as the default domain. ... Les Connor [SBS Community Member - SBS MVP] ...
    (microsoft.public.windows.server.sbs)
  • Re: Group Policy Precedence
    ... Create new GPO with the lockdown settings and apply it to all Domain ... Create a new security group, but don't add any users to it. ... Read' and 'Deny Apply Group Policy' permission. ...
    (microsoft.public.windows.group_policy)
  • Re: Publishing/Assigning Applications
    ... > default domain policy. ... you are not creating the GPO there AT the OU. ... Authenticated Users security group is given both the READ and APPLY GROUP ...
    (microsoft.public.win2000.group_policy)
Loading