GPO question

[TinRam]

GPO is applied to an OU that houses a computer. Lets call this GPO “IE_Settings”. This GPO has the loopback policy set to “Replace”.
User is in another OU. I would like have “IE_Settings” NOT apply to this user.

Possible?

I know that the usual way of setting the ACL of the GPO to deny the “apply” right for that user will not work since this policy is applied to the computer, not the user.

Thanks... nobody appears to know how to do this. Maybe its not not possible.

 

[MoobyCow]

I think you're out of luck. Not being able to apply User settings is kind of the point of using the replace option in loopbacks.

Maybe if you set the user OU group policy settings to not be overridden (there's a check box someplace on the GP)?

 

[TinRam]

Great idea. Didn’t work though. After you suggested it I did some reading on this and also tried it out. This is called “enforce” in 2003 BTW. Looks like this setting will force inheritance, even if loopack is enabled, but it does not force the GPO to override the loopback if it is not a parent. So in other words, If I for example make the change on the domain policy and turn on “enforce” it will override the loopback. But putting this on the user’s OU will not override it.



Great idea though… good thinking! Thanks!

 

[gmail2]

Not 100% sure if this would work, but what about if you create a second policy called "NOT_IE" and set permissions on it so that only the users from that certain OU could apply the policy - then configure loopback processing on it and also disable proxy (or whatever you need to do). Just make sure that the policy is processed second - ie after the main IE_Settings policy. I'm not 100% sure if it'll work, but it's worth a try I guess. After all, the settings are still applied by the user - just read from the policy where the computer resides instead ... to the best of my knowledge anyway

Irish Poetry - Karen O'Connor
Get your Irish Poetry Published
Garten und Landschaftsbau

 

[ncotton]

why are you using loopback at all, general rule for win03 was to try and move away from looping.

if you just want it to be used on machines with certain users,, apply machine policies and filter users on sec groups

Hope this Helps.

Neil J Cotton
njc Information Systems
Systems Consultant