Re: Group Policy and Local Policy

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance

Howdy Ahmad!

Darkz wrote:
I am trying to use group policy settings to provide control over our
clients and from what i know , if a pc is part of a domain the domain
policy takes precedence over the local computer policy.Is this still
true when the local admin is logged on to the computer?

Yes, that is still true. If you mean the Builtin administrator by "the local admin", then only the computer configurations of your group policies will take effect since the local admin is no user in your Active Directory and is therefore not targeted.

Also, if a
domain user has local admin rights on the computer that he/she is
logged on to which policy takes precedence?

Both do. If the settings contradict each other, the settings coming from the domain always "win". It's L-S-D-OU. Local Polcies get overriden by site policies that get overriden by domain policies that get overriden by... and so on ;-)

cheers,

Florian
--
Nachwuschsadmin aus dem Süddeutschen/Germany.
eMail: Vorname [bei] frickelsoft [Punkt] net.
.

Relevant Pages

  • RE: Local Admin. Password
    ... Kerberos settings) are all defined in the Default Domain GPO. ... Controllers are responsible for enforcing these domain-wide policies, ... different local password policy on workstations or servers by including ... | Thread-Topic: Local Admin. ...
    (microsoft.public.win2000.general)
  • Group Policy and Local Policy
    ... I am trying to use group policy settings to provide control over our ... clients and from what i know, if a pc is part of a domain the domain ... policy takes precedence over the local computer policy.Is this still ... domain user has local admin rights on the computer that he/she is ...
    (microsoft.public.win2000.group_policy)
  • Re: Restricted Groups...with exceptions
    ... one has a separate policy for access restrictions, IPSec, etc. ... now my requirement is certain users need local admin access to all PCs ... multiple sites and then I assume i'd need to manually add my global groups) ...
    (microsoft.public.win2000.group_policy)
  • Re: Securing Enterprise Policy from local admins
    ... permission on a local resource to be denied to a local admin by default. ... would be no way to prevent the change to the enterprise security policy. ... > security admins or domain admins can modify the enterprise policy. ...
    (microsoft.public.dotnet.security)
  • RE: Local policy Settings
    ... "Jon" wrote: ... > network, meaning, is your domain account a local admin on that PC? ... >> try to change to policy settings are all greyed out. ...
    (microsoft.public.windowsxp.general)