Re: MACHINE ACCOUNT filtering of group policy

From: Andy Cadley (ac_at_uea.ac.uk)
Date: 05/14/04 

Date: Fri, 14 May 2004 16:32:51 +0100

Put the machines you want it to apply to in a group and then only give Read
and Apply permissions to that group.

Be careful to remove Authenticated Users as this will include all the
computer accounts, which is not what you want.

Andy

"JayDee" <Darius_Falt@hotmail.com> wrote in message
news:eGMNeIBOEHA.1104@TK2MSFTNGP10.phx.gbl...
> Hi all
>
> Can anyone tell me if its possible to filter group policy within an OU by
> MACHINE?
>
> I can filter by user, no problem. - create a group containing exempted
> users, and set permission on the GP object to "deny apply group policy" -
> works a treat
>
> but when I tried using a similar procedure with machine accounts, it didnt
> appear to work - the policies still get applied
>
> I'm trying to prevent some specific machines from applying certain GP
> objects, - both machine and user settings within the object must be
> prevented from being applied
> specifically I'm trying to stop a couple of machines from getting machine
/
> user software installation settings
>
> I dont really want to alter the structure of my organisation and start
> creating OU's for exception objects, becuase it works pretty well as it
is,
> and I only have a handful of exceptions that I'd rather filter on some
kind
> of 'security group' basis
>
> I've tried creating a security group that contains the machine accounts
> where I dont want to apply policy.
> i've then added this security group into the permissions for the GP
Object,
> with DENY READ, and DENY APPLY GROUP POLICY
>
> reboot the machine - the policy is still apllied :~
>
> I was thnking perhaps its not possible to do with machine accounts in
groups
> 'per-se'
> maybe I have to do a WMI filter or somthing?
>
> would this be a correct assumption?
>
> any help appreciated.
>
> indebted to your guru-ness, as always ;)
>
> J
>
>

Relevant Pages

  • Re: MACHINE ACCOUNT filtering of group policy
    ... > Can anyone tell me if its possible to filter group policy within an OU by ... > I can filter by user, ... > but when I tried using a similar procedure with machine accounts, ... > I've tried creating a security group that contains the machine accounts ...
    (microsoft.public.windows.group_policy)
  • Re: MACHINE ACCOUNT filtering of group policy
    ... > Can anyone tell me if its possible to filter group policy within an OU by ... > I can filter by user, ... > but when I tried using a similar procedure with machine accounts, ... > I've tried creating a security group that contains the machine accounts ...
    (microsoft.public.windows.group_policy)
  • MACHINE ACCOUNT filtering of group policy
    ... Can anyone tell me if its possible to filter group policy within an OU by ... I can filter by user, ... I've tried creating a security group that contains the machine accounts ...
    (microsoft.public.windows.group_policy)
  • Re: security permissions of rolesusers on table rows
    ... Panagiotis, ... The classic method of providing row level access to contents of a table is ... If you want to dynamically filter rows in a single view rather than managing ... > permissions on each row. ...
    (microsoft.public.sqlserver.security)
  • Re: How to login user automatically? (for IP Filter firewall)
    ... > to hack IP Filter, some unsuspected weakness, with the result ... > being root privileges; and while I realize that's not at all likely it is ... > want to run it from a less priviledged account, can I do that without having ... > assume IP Filter file and directory permissions can address that question ...
    (comp.unix.bsd.freebsd.misc)