Group Policy - Enforced Below Enforced

mace7616 · 2010-07-23T13:46:13.000Z

I’m running Server 2003.

In active directory, I have a GPO that is Enforced for the entire Domain, but I have a particular machine that needs a setting that contradicts that original GPO. Can I enforce the lower level GPO and have it take precedence over the domain-level-also-enforced GPO?

Or would that create a rift in the space-time continuum which would destroy the universe? Or maybe just that machine at the least.

Matt

smusser · 2010-07-23T13:57:40.000Z

Create OU for the “one” workstation. Move the workstion to the OU. Apply policies as needed. Done!

Briser-fae-the-broch · 2010-07-26T01:13:32.000Z

+1 for Steve. It is possible to create an OU within and filter out the global one by various means, blocking inheritance etc but this is the simplest way to do what you want.

thomas1074 · 2010-07-26T02:50:38.000Z

Or you can apply a GPO to the OU the computer resides, filter it so it only applies to this machine, make your preferences and enforce this GPO, too.

This should override the domainsettings because of the order GPOs are processed, unless your are setting password preferences in a w2k3 domain.

smusser · 2010-07-26T05:12:50.000Z

Just remember that deny always takes precedence over allow. So if your policies have any overlapping settings it is best to apply them by segregating the objects into separate OU’s.

Nick-C · 2010-07-26T05:18:32.000Z

Plus having seperate OU’s for special policies makes it much easier to manage than trying to track down a policy that is being filtered on just 1 PC.