Re: Group Policy Precedence

OK, how about this as a revised suggestion to overcome that:

1. Create new GPO with the lockdown settings and apply it to all Domain
Users.
2. Create a new security group, but don't add any users to it.
3. On the ACL of the Group Policy, assign the new security group the 'Deny
Read' and 'Deny Apply Group Policy' permission.
4. When you find users you don't want the settings to apply to, add them to
the security group. The Deny permission from the security group will trump
the Allow permission from Domain Users.

By the way, it's pretty trivial to script the creation of a new security
group that automatically contains all user accounts. I still reckon the
first suggestion is the best way to go for Group Policy simplicity, even if
it involves more work up front. When you start using multiple GPOs with
conflicting settings or start using deny permissions it can make future
troubleshooting more difficult.

"Saucer Man" <saucerman@xxxxxxxxxx> wrote in message
news:Ga2dnbBPR8-oLMTfRVn-gg@xxxxxxxxxxxxxxx
>I though about this but it requires extra work. This will require someone
>to put every user in this new security group. There could be error here.
>If I use Domain Users, it is done for me automatically. Thanks for the
>sugesstion.
>
> --
>
> Thanks.
>
>
> "Simon Geary" <simon_geary@xxxxxxxxxxx> wrote in message
> news:%23pkC2jgPFHA.1528@xxxxxxxxxxxxxxxxxxxxxxx
>> Group Policy is applied in this order: Local Security policy, Site
>> policy, Domain policy, OU policy, child OU policy.
>>
>> Perhaps a better way to do what you want would be to use security
>> filtering. This might be easier to implement and requires having just the
>> one policy. Assuming all your users are in the same OU, you could do
>> this:
>>
>> 1. Create a new security group in the users OU and put all your user
>> accounts in it.
>> 2. Create a new GPO that has the IE lockdown settings, link it to the
>> users OU and use security filtering so that only the new security group
>> has the Read and Apply Group Policy permissions.
>> 3. Whenever you discover users you don't want the policy to apply to,
>> remove them from the new security group.
>>
>> "Saucer Man" <saucerman@xxxxxxxxxx> wrote in message
>> news:BO2dncX-9YtE9sTfRVn-qA@xxxxxxxxxxxxxxx
>>>I have two Group Policies. One of them locks IE and the other one
>>>doesn't. I want to apply the one that locks IE to the Domain User group
>>>that so initially, everyone's one is locked. Then as I discover who
>>>should not be unlocked, I want to add them to the Group Policy which does
>>>not lock IE. How do I set this up so that the unlock policy takes
>>>precedence over the locked one?
>>>
>>> --
>>>
>>> Thanks.
>>>
>>>
>>>
>>
>>
>
>


.

Relevant Pages

  • Re: GPO testing
    ... Here are the steps I used to create and link the GPO: ... Placed two users in the security group Test Group. ... Right clicked on the new policy called "test" and selected edit. ... Test Group on my XP workstation. ...
    (microsoft.public.windows.group_policy)
  • Re: Group Policy Precedence
    ... Create new GPO with the lockdown settings and apply it to all Domain ... Create a new security group, but don't add any users to it. ... On the ACL of the Group Policy, assign the new security group the 'Deny ... > Read' and 'Deny Apply Group Policy' permission. ...
    (microsoft.public.windows.group_policy)
  • Re: Creating Additional SMTP emails in Exchange
    ... Instead I added the users to the Security Group Domain B ... first and then apply the policy. ... Primary SMTP as well as the default domain. ... Les Connor [SBS Community Member - SBS MVP] ...
    (microsoft.public.windows.server.sbs)
  • Re: Publishing/Assigning Applications
    ... I think where you erred was in creating the software policy right below the ... 'package' when the computer leaves the scope of influence, ... Apply a software package for say Office 2003 to it. ... add Accounting_Computers (or whatever you named the security group) ...
    (microsoft.public.win2000.group_policy)
  • Re: Publishing/Assigning Applications
    ... > default domain policy. ... you are not creating the GPO there AT the OU. ... Authenticated Users security group is given both the READ and APPLY GROUP ...
    (microsoft.public.win2000.group_policy)
Loading