0

What is the correct method to apply various group policy settings to multiple groups of users?

An example of the scenario: Windows server 2008, domain "CompanyName". Presume all users switch between all PC's with a roaming profile.

GP = group policy, GPO = group policy object, OU = Organisational unit.

I have two OU's inside my main Users OU, as follows:

CompanyName Users
    Standard Users
        UserA
        UserB
    Power Users
        UserC
        UserD

For Standard users I want Control Panel disabled. Which I can achieve fine by applying GPO to that OU.

For Power Users I want the background set to a certain picture. I can also achieve fine.

Here is where the problem comes in, UserA and UserC both use a program that requires certain firewall settings which I'd like to apply through GP. Putting this GPO in the main OU (CompanyName Users) then filtering the users it can apply to, I presume would work. However is this the correct way to do it?

What is the correct/best way to go about this? Is there a better way to arrange my OU's?

  • Putting this GPO in the main OU (CompanyName Users) then filtering the users it can apply to, I presume would work. However is this the correct way to do it? Yes. Why don't you think it is? – Ƭᴇcʜιᴇ007 Nov 21 '16 at 19:57
  • You can also add a child OU and apply the policy there. With inheritance enabled the users in that OU will get both sets of policies. And the users in the parent OU will only get the top level policies applied. This is my preferred way since it is easier to overview. – Jens Ehrich Dec 11 '16 at 18:47
0

It's not hard as you think it is first of all you need to create separate groups for users A,B,C,D and add each user to its appropriate group, next thing you need to do is create a GPO under the OU you need to apply on, and assign the policy on specific groups . Remove the authenticated users that comes by default and applies the GP on, and add the appropriate group on the selected GPO, that way the GP will apply on the group you only added, it will ignore anyone else that is not in the groups you added . IN example if you created a policy to restrict access to control panel and applied it to Group A, if group B joins it will not be restricted cause it's not applied to it by the GPO cause you only added group A .

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy