Re: Exclude from GPO ..

The principal should stay as Authenticated Users. No need for EVERYONE.
Non-domain members aren't going to be trying to process the GPO anyway.

The reason you should only deny Apply Policy, and leave the read permission
has to do with how the clients find the policies, I believe. If you have no
permissions to a GPO, then the CSEs cannot read it and will error.
Remember, Computer configuration runs as (impersonates) your computer
account and user config impersonates the user who is logging/ logged on.

There are no real reasons why you should not use the Default policies. Many
people think them special, but they're not really. Although they do have
the same GUID no matter where you are. Deleting them is bad, modifying them
is fine. Although Cary raises a good point re. restoring them. As they are
the defaults you shouldn't delete them. Therefore, if there are problems
they need to be reset, which can result in you losing configuration
settings, as the changes you've made are not tracked.

Mike,

I've written a quick article on policy filtering here:
-- http://www.msresource.net/content/view/25/47/


Although it's probably not much different from the KB posted by Paul :(

--
Paul Williams
Microsoft MVP - Windows Server - Directory Services
http://www.msresource.net | http://forums.msresource.net


.

Relevant Pages

  • Re: Computer componet of GP not being applied
    ... When you open the GPO for editing, ... Configuration and User Configuration. ... >> If you look at the properties of the OU in which the Terminal Server ... >>> It all seems to be linked to the local user groups on the terminal ...
    (microsoft.public.windows.group_policy)
  • Re: Computer componet of GP not being applied
    ... When you open the GPO for editing, ... Configuration and User Configuration. ... >> If you look at the properties of the OU in which the Terminal Server ... >>> It all seems to be linked to the local user groups on the terminal ...
    (microsoft.public.windows.group_policy)
  • Re: More than one GPO on the same OU
    ... How does the Group Policy 'No Override' and 'Block Inheritance' work? ... NO OVERRIDE option of a GPO ... > COMPUTER CONFIGURATION ... [Christoffer Andersson] ...
    (microsoft.public.win2000.group_policy)
  • Re: GP Policy setup
    ... Deploying software via GPO ... I figured out that there were two settings. ... You configure the User Configuration side of things to ... >> OU in which the user account object directly resides. ...
    (microsoft.public.win2000.group_policy)
  • Re: GPO not taking affect
    ... A GPO is logically made up of two sections - Computer Configuration and User ... Settings under User Configuration affect user accounts the ...
    (microsoft.public.win2000.group_policy)