Applying a policy to a group

[Guest]

Archived from groups: microsoft.public.win2000.active_directory (More info?)

I have read some posts on applying and am only writing to see if what I
have read is correct...

Create an Organisational Unit in Active Directory Users and Groups
Create a new group in the new OU by right clicking and selecting
new->group
double click the new group and click the members tab
click the add button and select the computers and users you want to
apply the policy to.
Once this is done, right click the new OU name in AD Users and
Computers and click the Group Policy Tab.
Click the New button and rename the new policy name.
click properties and set the deired policy details.

If this is wrong or there is more to it, could you guys let me know?

Thanks...

 

[Guest]

Archived from groups: microsoft.public.win2000.active_directory (More info?)

GP cannot be applied to groups. It can only be applied to Computer or User
accounts. Placing a group into OU and then applying GPO to that OU won't do
anything.

If you need to filter who gets the policy based on the group membership,
apply the GPO to all user and/or computer accounts (for example, at the
domain level). THEN, edit GPO,s ACL to remove "Apply Policy" permission from
the Authenticated Users (who have it by default) and then grant it only to
the group you want.

--
Dmitry Korolyov [d__k@removethispart.mail.ru]
MVP: Windows Server - Directory Services


<karl.rhodes@keywave.com> wrote in message
news:1115999149.297539.94890@g44g2000cwa.googlegroups.com...
>I have read some posts on applying and am only writing to see if what I
> have read is correct...
>
> Create an Organisational Unit in Active Directory Users and Groups
> Create a new group in the new OU by right clicking and selecting
> new->group
> double click the new group and click the members tab
> click the add button and select the computers and users you want to
> apply the policy to.
> Once this is done, right click the new OU name in AD Users and
> Computers and click the Group Policy Tab.
> Click the New button and rename the new policy name.
> click properties and set the deired policy details.
>
> If this is wrong or there is more to it, could you guys let me know?
>
> Thanks...
>

 

[Guest]

Archived from groups: microsoft.public.win2000.active_directory (More info?)

Im still fairly new to all this and have a couple of questions still...

1. What is GPO?
2. How do you apply a policy to all users? Using the Domain Policy
editor?
3. Once the policy has been applied to all users, how do you
specifically remove a policy from certain users?

As a request, could we not use initials (GPO, OU, AD, ACL, etc) anymore
as there are obviously loads out there, and I dont know what they all
mean!

Thanks

 

[Guest]

Archived from groups: microsoft.public.win2000.active_directory (More info?)

Please don't take too much offense to this but if you don't know what
basic acronymns like GPO, OU and the like stand for then you probably
shouldn't be messing around with your company's AD (whoops!) network. If
you're in the learning process then that's great and wish you luck but
I'd advise brushing up a bit on the essentials.

karl.rhodes@keywave.com wrote:
> Im still fairly new to all this and have a couple of questions still...
>
> 1. What is GPO?
> 2. How do you apply a policy to all users? Using the Domain Policy
> editor?
> 3. Once the policy has been applied to all users, how do you
> specifically remove a policy from certain users?
>
> As a request, could we not use initials (GPO, OU, AD, ACL, etc) anymore
> as there are obviously loads out there, and I dont know what they all
> mean!
>
> Thanks
>

 

[Guest]

Archived from groups: microsoft.public.win2000.active_directory (More info?)

> 1. What is GPO?

Group Policy Object. The abbreviation for a Group Policy.


> 2. How do you apply a policy to all users? Using the Domain Policy editor?

Yes, that's the easiest way. Although it is generally recommended that you
don't edit the Default Domain GPO and that you create a new GPO above it (in
the list) and configure your policies in there.


> 3. Once the policy has been applied to all users, how do you specifically
> remove a policy from certain users?

By using a technique called GPO filtering:
-- http://www.msresource.net/content/view/15/47/


Note that the examples in that article are geared to filtering policies to a
subset of users rather than filtering out one or two. The principal is the
same. You simply filter out a user by enabling a policy for all users (a
scope like the domain) and then denying a group apply permissions to this
GPO and adding users into this group.


> As a request, could we not use initials (GPO, OU, AD, ACL, etc) anymore as
> there are obviously loads out there, and I dont know what they all mean!
>

No can do. It saves too much typing ;-) If in doubt just ask, no
worries...

Or stick the acronym into Google...

--
Paul Williams
Microsoft MVP - Windows Server - Directory Services
http://www.msresource.net | http://forums.msresource.net