How to disallow group policies on windows 2000 servers

Toggle sidebar Toggle sidebar
T

TJ

Distinguished
Apr 6, 2004
256
0
18,780
Archived from groups: microsoft.public.win2000.active_directory (More info?)

Hi Folks:
We have a corporate wide group policies which basically map drive letters
and automatically start our intranet site via Internet Explorer etc. After
awhile it gets annoying when I login to multiple servers. Is there a way to
only disallow the running of this group policy if an administrator or user is
logging into a windows 2000 server? Please advise.
 
G

Guest

Guest
Archived from groups: microsoft.public.win2000.active_directory (More info?)

Yes, you use what's called Group Policy Filtering.

Here's a how to:
-- http://www.msresource.net/content/view/15/47/


This article covers granting to specific users and groups more than stopping
them, but the principle is the same. You simply use the deny permission in
your case instead of the allow permission.

--

Paul Williams

http://www.msresource.net/
http://forums.msresource.net/

"TJ" <TJ@discussions.microsoft.com> wrote in message
news:A07745CE-3911-4FF5-8B92-233E50702CE4@microsoft.com...
Hi Folks:
We have a corporate wide group policies which basically map drive letters
and automatically start our intranet site via Internet Explorer etc. After
awhile it gets annoying when I login to multiple servers. Is there a way to
only disallow the running of this group policy if an administrator or user
is
logging into a windows 2000 server? Please advise.
 
G

Guest

Guest
Archived from groups: microsoft.public.win2000.active_directory (More info?)

Hi TJ

If the settings are applied via computer configuration in the GPO to the
computers, I don't know a way of avoiding it. If they are implemented via
user configuration in the GPO, you can deny the "apply group policy" right
to the admins that shouldn't have it.

Kind regards
--
Mark Renoden [MSFT]
Windows Platform Support Team
Email: markreno@online.microsoft.com

Please note you'll need to strip ".online" from my email address to email
me; I'll post a response back to the group.

This posting is provided "AS IS" with no warranties, and confers no rights.

"TJ" <TJ@discussions.microsoft.com> wrote in message
news:A07745CE-3911-4FF5-8B92-233E50702CE4@microsoft.com...
> Hi Folks:
> We have a corporate wide group policies which basically map drive
> letters
> and automatically start our intranet site via Internet Explorer etc.
> After
> awhile it gets annoying when I login to multiple servers. Is there a way
> to
> only disallow the running of this group policy if an administrator or user
> is
> logging into a windows 2000 server? Please advise.
 
G

Guest

Guest
Archived from groups: microsoft.public.win2000.active_directory (More info?)

In the case of the servers, he should be able to deny the computer accounts
of the servers from running the GPO, correct?

I have never had a need to do this based on computer account... then again,
I usually have servers in a different OU than workstations and filter that
way.

--
Ryan Hanisco
MCSE, MCDBA
Flagship Integration Services

"Mark Renoden [MSFT]" <markreno@online.microsoft.com> wrote in message
news:Ot6d12N$EHA.3840@tk2msftngp13.phx.gbl...
> Hi TJ
>
> If the settings are applied via computer configuration in the GPO to the
> computers, I don't know a way of avoiding it. If they are implemented via
> user configuration in the GPO, you can deny the "apply group policy" right
> to the admins that shouldn't have it.
>
> Kind regards
> --
> Mark Renoden [MSFT]
> Windows Platform Support Team
> Email: markreno@online.microsoft.com
>
> Please note you'll need to strip ".online" from my email address to email
> me; I'll post a response back to the group.
>
> This posting is provided "AS IS" with no warranties, and confers no
rights.
>
> "TJ" <TJ@discussions.microsoft.com> wrote in message
> news:A07745CE-3911-4FF5-8B92-233E50702CE4@microsoft.com...
> > Hi Folks:
> > We have a corporate wide group policies which basically map drive
> > letters
> > and automatically start our intranet site via Internet Explorer etc.
> > After
> > awhile it gets annoying when I login to multiple servers. Is there a
way
> > to
> > only disallow the running of this group policy if an administrator or
user
> > is
> > logging into a windows 2000 server? Please advise.
>
>
 
G

Guest

Guest
Archived from groups: microsoft.public.win2000.active_directory (More info?)

Yeah exactly


--
Mark Renoden [MSFT]
Windows Platform Support Team
Email: markreno@online.microsoft.com

Please note you'll need to strip ".online" from my email address to email
me; I'll post a response back to the group.

This posting is provided "AS IS" with no warranties, and confers no rights.

"Ryan Hanisco" <rhanisco@flagshipis.com> wrote in message
news:u9G507N$EHA.3708@TK2MSFTNGP14.phx.gbl...
> In the case of the servers, he should be able to deny the computer
> accounts
> of the servers from running the GPO, correct?
>
> I have never had a need to do this based on computer account... then
> again,
> I usually have servers in a different OU than workstations and filter that
> way.
>
> --
> Ryan Hanisco
> MCSE, MCDBA
> Flagship Integration Services
>
> "Mark Renoden [MSFT]" <markreno@online.microsoft.com> wrote in message
> news:Ot6d12N$EHA.3840@tk2msftngp13.phx.gbl...
>> Hi TJ
>>
>> If the settings are applied via computer configuration in the GPO to the
>> computers, I don't know a way of avoiding it. If they are implemented
>> via
>> user configuration in the GPO, you can deny the "apply group policy"
>> right
>> to the admins that shouldn't have it.
>>
>> Kind regards
>> --
>> Mark Renoden [MSFT]
>> Windows Platform Support Team
>> Email: markreno@online.microsoft.com
>>
>> Please note you'll need to strip ".online" from my email address to email
>> me; I'll post a response back to the group.
>>
>> This posting is provided "AS IS" with no warranties, and confers no
> rights.
>>
>> "TJ" <TJ@discussions.microsoft.com> wrote in message
>> news:A07745CE-3911-4FF5-8B92-233E50702CE4@microsoft.com...
>> > Hi Folks:
>> > We have a corporate wide group policies which basically map drive
>> > letters
>> > and automatically start our intranet site via Internet Explorer etc.
>> > After
>> > awhile it gets annoying when I login to multiple servers. Is there a
> way
>> > to
>> > only disallow the running of this group policy if an administrator or
> user
>> > is
>> > logging into a windows 2000 server? Please advise.
>>
>>
>
>
 
You must log in or register to reply here.

TRENDING THREADS

Latest posts

Moderators online

Share this page

COMPANY
RESOURCES
FOLLOW
Top Bottom