GPO question

[kai91]

Hi everyone,

I have a computer defined gpo with software restrictions in. How can i make this policy not apply when i have a domain user logged onto a machine? Thanks

[abillybob]

You can't as far as I'm aware!

[budgester]

At what level are your software restrictions applied ? Domain Level, User/Group Level OU/Computer level ?

 

Should the software restrictions only apply when a workstation is logged onto as a local user ?

[kai91]

Thanks for the reply, the gpo is applied at ou level. The gpo should apply for all users except system admins but this isnt happening at the minute

[Norphy]

If you've got a GPO set to a container of which your user is a member of and you don't want it applying to it, you need to set the permissions on the GPO to prevent it from happening. The easiest way is open the GPO, right click at the top and go to properties, go Security and set the "Apply Group Policy" permission to Deny.

 

[ADMaster]

In addition to @Norphy ‘s suggestion of applying an ACL to the GPO there are a number of options that may work better in the long term. Best practice says ACL’s on the GPO should be used as a last resort.

1 I’ve attached a screen shot that shows you can set the enforcement of the SRP and exclude local admin accounts.

2 move the settings to the user configuration and apply it to the users OU, this will exclude all local users. It will also exclude the local admin account unless you apply it at domain level.

3 move all the restrictions to applocker. (enterprise sku required). This is the path I’m going to work on this summer. Convert all my SRPs to applocker. It has the flexibility to define rules for specific users and groups.

 

Currently my SRPs are split into two policies one applied to the staff OU and one applied to the student OU. In theory I’ll be able to combine this into one policy for all with different rules.

 

Cheers,