Active Directory Grpoup policy 1

[biaman]

hi,

I'm looking for some advice.

1) Is there a way of setting up AD-GP so I can use different logon scrips for different user groups via AD-GP.

2) We are locking the users PC's down and want to remove access to the "add / remove programs", but on testing this it even locks out the administrator from doing so!!! not a lot of good to an administrator adding or removing a programs from a users machine.

 

[trusted]

If you are aplying the GPO at the domain level this can happen. You have two ways around this. One way is to filter the Policy so the the admin has read but not the apply group policy permission. Right click on the policy choose properties and select the security tab to accomplish this

The easier way IMO is to put the users in an OU/s and apply the policy there.

The only policies that have to be applied at the domain level in order to work are the Account Policies. All of the others.

JC

 

[biaman]

Thanks Trusted, I understand now.

 

[markdmac]

JC's suggestion is a good one. I'll offer another perspective. I don't like having to support too many login scripts when for the most part the customizations between groups only vary slightly. I prefer to use a single script that is intelligent enough to know what groups my users are members of and take action from there.

Please take a look at this FAQ which I think will be of great interest to you. faq329-5798

I hope you find this post helpful.

Regards,

Mark