Group Policy question .

Hi All

We are testing group policy at the moment, sadly running into some issue

we creted 4 OU Uses, Workstations, Servers and Groups

all users in the users OU and all workstations will goes to workstation OU.
we have link various policy to those OU, to control which workstation or
users get the correct policy, we will do this via Security filtering, so what
i done is created a Global groups called " policy workstation default" 100s
of computers are members of this this policy

my question is what is the best way to unlook all the users and computers
policy, when a desktop support person login to those computres ?

Thank you

That would depend on which policy settings in particular you are referring
to. If you want to restrict specific set of features but exclude your
support staff from these restrictions, you can use for this purpose settings
under User Configuration portion of relevant GPOs linked to your Users OU.
Similarly, if you are applying specific set of user rights via a GPO linked
to the Workstations OU, you can designate within individual policy settings
which users or groups are in scope.

hth
Marcin

"mr555" <mr555@discussions.microsoft.com> wrote in message
news:A764F209-7ADF-484F-9FEA-3E90365CC16B@microsoft.com...
> Hi All
>
> We are testing group policy at the moment, sadly running into some issue
>
> we creted 4 OU Uses, Workstations, Servers and Groups
>
> all users in the users OU and all workstations will goes to workstation
> OU.
> we have link various policy to those OU, to control which workstation or
> users get the correct policy, we will do this via Security filtering, so
> what
> i done is created a Global groups called " policy workstation default"
> 100s
> of computers are members of this this policy
>
> my question is what is the best way to unlook all the users and computers
> policy, when a desktop support person login to those computres ?
>
> Thank you
>
>

Howdie!

mr555 schrieb:
> all users in the users OU and all workstations will goes to workstation OU.
> we have link various policy to those OU, to control which workstation or
> users get the correct policy, we will do this via Security filtering, so what
> i done is created a Global groups called " policy workstation default" 100s
> of computers are members of this this policy
>
> my question is what is the best way to unlook all the users and computers
> policy, when a desktop support person login to those computres ?

The easiest approach would be seperating the support stuff into another
OU or putting them into another security group and deny them "Apply
Group Policy" permission. Depending on what your setup looks like, I'd
go for the OU-seperation as this is way clearer and easier to document.

Cheers,
Florian
--
Microsoft MVP - Group Policy
eMail: prename [at] frickelsoft [dot] net.
blog: http://www.frickelsoft.net/blog.
Maillist (german): http://frickelsoft.net/cms/index.php?page=mailingliste