Sign in with
Sign up | Sign in
Your question

How to disallow group policies on windows 2000 servers

Last response: in Windows 2000/NT
Share
January 17, 2005 4:31:01 PM

Archived from groups: microsoft.public.win2000.active_directory (More info?)

Hi Folks:
We have a corporate wide group policies which basically map drive letters
and automatically start our intranet site via Internet Explorer etc. After
awhile it gets annoying when I login to multiple servers. Is there a way to
only disallow the running of this group policy if an administrator or user is
logging into a windows 2000 server? Please advise.
Anonymous
January 18, 2005 12:39:20 AM

Archived from groups: microsoft.public.win2000.active_directory (More info?)

Yes, you use what's called Group Policy Filtering.

Here's a how to:
-- http://www.msresource.net/content/view/15/47/


This article covers granting to specific users and groups more than stopping
them, but the principle is the same. You simply use the deny permission in
your case instead of the allow permission.

--

Paul Williams

http://www.msresource.net/
http://forums.msresource.net/

"TJ" <TJ@discussions.microsoft.com> wrote in message
news:A07745CE-3911-4FF5-8B92-233E50702CE4@microsoft.com...
Hi Folks:
We have a corporate wide group policies which basically map drive letters
and automatically start our intranet site via Internet Explorer etc. After
awhile it gets annoying when I login to multiple servers. Is there a way to
only disallow the running of this group policy if an administrator or user
is
logging into a windows 2000 server? Please advise.
Anonymous
January 18, 2005 11:44:19 AM

Archived from groups: microsoft.public.win2000.active_directory (More info?)

Hi TJ

If the settings are applied via computer configuration in the GPO to the
computers, I don't know a way of avoiding it. If they are implemented via
user configuration in the GPO, you can deny the "apply group policy" right
to the admins that shouldn't have it.

Kind regards
--
Mark Renoden [MSFT]
Windows Platform Support Team
Email: markreno@online.microsoft.com

Please note you'll need to strip ".online" from my email address to email
me; I'll post a response back to the group.

This posting is provided "AS IS" with no warranties, and confers no rights.

"TJ" <TJ@discussions.microsoft.com> wrote in message
news:A07745CE-3911-4FF5-8B92-233E50702CE4@microsoft.com...
> Hi Folks:
> We have a corporate wide group policies which basically map drive
> letters
> and automatically start our intranet site via Internet Explorer etc.
> After
> awhile it gets annoying when I login to multiple servers. Is there a way
> to
> only disallow the running of this group policy if an administrator or user
> is
> logging into a windows 2000 server? Please advise.
Related resources
Anonymous
January 18, 2005 11:44:20 AM

Archived from groups: microsoft.public.win2000.active_directory (More info?)

In the case of the servers, he should be able to deny the computer accounts
of the servers from running the GPO, correct?

I have never had a need to do this based on computer account... then again,
I usually have servers in a different OU than workstations and filter that
way.

--
Ryan Hanisco
MCSE, MCDBA
Flagship Integration Services

"Mark Renoden [MSFT]" <markreno@online.microsoft.com> wrote in message
news:o t6d12N$EHA.3840@tk2msftngp13.phx.gbl...
> Hi TJ
>
> If the settings are applied via computer configuration in the GPO to the
> computers, I don't know a way of avoiding it. If they are implemented via
> user configuration in the GPO, you can deny the "apply group policy" right
> to the admins that shouldn't have it.
>
> Kind regards
> --
> Mark Renoden [MSFT]
> Windows Platform Support Team
> Email: markreno@online.microsoft.com
>
> Please note you'll need to strip ".online" from my email address to email
> me; I'll post a response back to the group.
>
> This posting is provided "AS IS" with no warranties, and confers no
rights.
>
> "TJ" <TJ@discussions.microsoft.com> wrote in message
> news:A07745CE-3911-4FF5-8B92-233E50702CE4@microsoft.com...
> > Hi Folks:
> > We have a corporate wide group policies which basically map drive
> > letters
> > and automatically start our intranet site via Internet Explorer etc.
> > After
> > awhile it gets annoying when I login to multiple servers. Is there a
way
> > to
> > only disallow the running of this group policy if an administrator or
user
> > is
> > logging into a windows 2000 server? Please advise.
>
>
Anonymous
January 18, 2005 12:25:09 PM

Archived from groups: microsoft.public.win2000.active_directory (More info?)

Yeah exactly


--
Mark Renoden [MSFT]
Windows Platform Support Team
Email: markreno@online.microsoft.com

Please note you'll need to strip ".online" from my email address to email
me; I'll post a response back to the group.

This posting is provided "AS IS" with no warranties, and confers no rights.

"Ryan Hanisco" <rhanisco@flagshipis.com> wrote in message
news:u9G507N$EHA.3708@TK2MSFTNGP14.phx.gbl...
> In the case of the servers, he should be able to deny the computer
> accounts
> of the servers from running the GPO, correct?
>
> I have never had a need to do this based on computer account... then
> again,
> I usually have servers in a different OU than workstations and filter that
> way.
>
> --
> Ryan Hanisco
> MCSE, MCDBA
> Flagship Integration Services
>
> "Mark Renoden [MSFT]" <markreno@online.microsoft.com> wrote in message
> news:o t6d12N$EHA.3840@tk2msftngp13.phx.gbl...
>> Hi TJ
>>
>> If the settings are applied via computer configuration in the GPO to the
>> computers, I don't know a way of avoiding it. If they are implemented
>> via
>> user configuration in the GPO, you can deny the "apply group policy"
>> right
>> to the admins that shouldn't have it.
>>
>> Kind regards
>> --
>> Mark Renoden [MSFT]
>> Windows Platform Support Team
>> Email: markreno@online.microsoft.com
>>
>> Please note you'll need to strip ".online" from my email address to email
>> me; I'll post a response back to the group.
>>
>> This posting is provided "AS IS" with no warranties, and confers no
> rights.
>>
>> "TJ" <TJ@discussions.microsoft.com> wrote in message
>> news:A07745CE-3911-4FF5-8B92-233E50702CE4@microsoft.com...
>> > Hi Folks:
>> > We have a corporate wide group policies which basically map drive
>> > letters
>> > and automatically start our intranet site via Internet Explorer etc.
>> > After
>> > awhile it gets annoying when I login to multiple servers. Is there a
> way
>> > to
>> > only disallow the running of this group policy if an administrator or
> user
>> > is
>> > logging into a windows 2000 server? Please advise.
>>
>>
>
>
!