GPO Computer Configuration at Admin Login

[Guest]

Archived from groups: microsoft.public.win2000.group_policy (More info?)

here is my scenario:

1) I've set the Default Domain Policy to not check an internal SUS for
updates.
2) I've set a AdminPolicy for one site in my enterprise to check a SUS any
apply any updates.
3) I've set Security Filtering to Domain Admins only.
3) The Computer Configuration Part doesn't apply because of an access denied
error at bootup.

How can i make the policy work only at Domain admin login?

Thanks
Mark Greifenberg

 

[Guest]

Archived from groups: microsoft.public.win2000.group_policy (More info?)

It cannot be limited to only Administrators that logon to the machine due to
the type of policy it is.

SUS policies are computer policies so the computer account would need access
to the policy to apply it. You would need to add the computer account with
Read and Apply group policies or Domain Computers group with those
permissions.

Also think about the order in which policies are applied. Local, then Site,
then Domain, Organizational Unit (L-S-D-OU) so the domain policy would be
overriding the Site policy anyway.

--
Gary Mudgett, MCSE, MCSA
Windows 2000/2003 Directory Services

=====================================================
When responding to posts, please "Reply to Group" via
your newsreader so that others may learn and benefit
from your issue.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

"Mark Greifenberg" <mark.greifenberg@gmx.net> wrote in message
news:#m79vWQaEHA.2544@TK2MSFTNGP10.phx.gbl...
> here is my scenario:
>
> 1) I've set the Default Domain Policy to not check an internal SUS for
> updates.
> 2) I've set a AdminPolicy for one site in my enterprise to check a SUS any
> apply any updates.
> 3) I've set Security Filtering to Domain Admins only.
> 3) The Computer Configuration Part doesn't apply because of an access
denied
> error at bootup.
>
> How can i make the policy work only at Domain admin login?
>
> Thanks
> Mark Greifenberg
>
>