Default Group Policy Object (Administrator override)

[DFavel]

Hello,

I have implemented the following structure. A domain called glacier.com. I edited the Default GPO so that users have no authority to author the MMC or its snap-ins. As well as other specific policies. I know I can create another Group Policy that only affects the users, but I have been told to do it this way.

The question is because it is the default group policy its settings also affect the Administrator account. How do I set this policy to only affect users and not the Administrator or Domain Administrator groups? Any suggestions would be great.

Thanks in Advance,

BigDman26

 

[ronnetp]

You have to create OUs (Organizational Units) then assign the administrators to that new OUs, and create the Group policy for that Group of users, so that you can have 2 two groups one restricted and not the other.

 

[mlichstein]

It is not a good idea to filter the Default Domain policy only to certain users.

It would be much better to create a separate GPO and apply it to an OU of users as ronnetp suggested.