0

I want to set a rule for all users in a domain. The rule turns on the screensaver after 15 minutes and then the user must use a password to login again.

Everything works, but I need to exclude one user who belong to this group. How can I do that?

2 Answers 2

1

You need to create a group and add all the users into it that you want you policy to apply on and exclude that user from that group ( do not add him to the group ) next thing to do is apply that policy on the group you created which contains all the users that you added to that group by removing authenticated users and replacing it with the group you created .

0

user673956's answer is the recommended route to go. Only add users whom you want the policy to apply to.

There is another approach. You can have the policy apply to people, but then alter the permissions of the policy to deny access to a certain person (or group, or computer account). MS KB 816100 provides step-by-step instructions.

There is a key reason why the approach from user673956's answer is preferred. Deny permissions have a higher priority, overriding allow permissions. If you do add a deny permission, there isn't a higher priority permission to override the deny. For instance, if you get more users that you want to have the policy not apply to, and put them in a group, and deny access to the group, there's no easy way to just slap on another permission to override the policy for just one member of the group.

As a general practice, if you take the time to only apply the policy to the people you actually want it to apply to, you don't end up trapping yourself into a corner of having an unwanted effect without any easy and straightforward way to fix the problem. Carefully applying the policy to only those you want it to apply to may take more time in the short term, but ends up being able to work well.

(As I'm discussing what is preferred, I'm basing a lot of this discussion on some training I received, involving a publication released by Microsoft. It was probably an official guide related to Windows Server 2003.)

I think that, in theory, this approach also speeds things up, because the end user's computer won't need to try to grab a policy just to find out that it isn't supposed to apply anyway.

However, denying permissions for a specific policy can be faster to implement, especially for just one user on a smaller network. So if you really think you want to go that route, it definitely is an option that is available. It is an option that Microsoft does teach in some official training materials, so go ahead and (cautiously decide to) use that option if you determine that is what makes the best sense for you.

1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .