How to apply Group Policy to User Organisational Units except on specific computers?

[Ironside]

Hi all.

 

We have a policy in place to block removable storage access - no USB pen drives for kids or staff. This policy is linked to various OUs containing users, and works via User Configuration.

 

Unfortunately, PE-DESIGN comes with a physical license USB which reads as a storage device. We need to get one PC to override the USB Block policy.

The problem is the USB Block works via User Configuration and is linked at the User OU.

 

How exactly does this interact with a Group Policy that applies Computer Management policies? If you have "Removable Disks: Deny read access" enabled for the user configuration policy, but Disabled via a Computer Configuration, which takes priority/overwrites the other?

 

How do I get my USB unblock to override a USB Block applied to User IYIt has to be on a specific PC - is there a method to do it with Security Filtering down to specific computers?

 

I have tried using Computer Configuration > System > Removable Storage Access policies with the policy still linking to the User OU, but this didn't work because the USB access was not denied. I have tried using User Configuration policies in my USB Unblock policy which is linked to the Computer OU of the one PC I need to unblock USBs for, but the USB block policy still applied and overrode my Unblock - or the Unblock just didn't apply at all. Honestly, not sure.

 

Anyone else had to work with something like this?

 

(I know a technicalyl valid solution is to rewrite the USB Block policy to link to computers and apply Computer configuration, but this has been bugging me for so long that I want to know a better solution that lets me overwrite User Configuration policies on specific computers, rather than rework the block policy to not apply by User at all.

[steveg]

Loopback policy should do what you need

 

https://learn.microsoft.com/en-us/troubleshoot/windows-server/group-policy/loopback-processing-of-group-policy

[PotNoodleTech]

I've put the handful of USB allowed pcs in a seperate OU with slightly different GPO applied. This only apples to the PC not the user so no risk of any settings following them around to other pcs. There may be better/newer ways of doing it but this works.

[thimon]

You could create a security group which you add your relevant computers to which you don’t want the policy applying to. In the GPO delegation settings, add the security group and select Deny to the Apply settings (remembering off the top of my head here).

[Ironside]

You could create a security group which you add your relevant computers to which you don’t want the policy applying to. In the GPO delegation settings, add the security group and select Deny to the Apply settings (remembering off the top of my head here).

A v. good suggestion but only for cases where the policy applies via Computer Configuration - we're blocking for users in certain OUs and the policy is a User Configuration setting, so this, while a valid solution for computer configuration, didn't quite fit my use case.

I've put the handful of USB allowed pcs in a seperate OU with slightly different GPO applied. This only apples to the PC not the user so no risk of any settings following them around to other pcs. There may be better/newer ways of doing it but this works.

Another good answer but it's not quite how I wanted to do it cause the USB block group policy applies to users not computers to allow certain users access. (Also I just really didn't want to re-jig the OUs or the policy if I could help it!)

Loopback policy should do what you need

 

https://learn.microsoft.com/en-us/troubleshoot/windows-server/group-policy/loopback-processing-of-group-policy

 

Yup, this did the trick! Cheers - this fills a major gap of my understanding of how group policy works!

[Ironside]

Update:

 

As it turns out, there was a USB ban in place in Impero that was preventing kids from using USBs. If you're having a similar issue to me, check if Impero still has policies applied to user groups in the siderbar on the left.

Edited February 6, 2025 by Ironside