What permissions are required to create a GPO anywhere in AD? If we
specically allow for eg full control on one particular OU to a group called
GPO admin - where users are simply domain users - the users can edit,
delete - do anything to any object in that OU - but they cannot create a
GPO.
NTFS permissons on SystemRoot and below... ... someone mistakenly created a GPO that sets NTFS ...replacing permissions below and enabling inheritance. ... Administrators = Full Control...SYSVOL folders are inconsistent with those in AD, ... (microsoft.public.windows.file_system)
Re: Loopback Processing ... As long as loopback is set in one GPO, ... >to be set in any other GPO that falls with the hierarchy? ... >why does it still apply the User Configuration settings.... >>computer provided it has permissions to the GPO's. ... (microsoft.public.windows.group_policy)
Re: dns administration delegation ...permissions that grant unnecessary rights. ... I wasn't aware of the GPO... these admins full access to their local dns servers (which are also domain ... (microsoft.public.windows.server.dns)
Re: dns administration delegation ... I'm more concerned about these admins to have the ... early in the deployment of DNS servers and then seldom if every ...permissions that grant unnecessary rights. ... I wasn't aware of the GPO... (microsoft.public.windows.server.dns)
Re: Computer componet of GP not being applied ... would expect that anything in the Computer Configuration portion of the GPO... By "non-standard permissions", I mean what are the permissions on the GPO? ... If you look at the properties of the OU in which the Terminal Server resides... > It all seems to be linked to the local user groups on the terminal server. ... (microsoft.public.windows.group_policy)
