Windows 2003 - Applying GPO for SupportAdmin

[Guest]

Archived from groups: microsoft.public.win2000.group_policy (More info?)

I work in a hospital that has around 5000 client pc's and around 350 servers.
We are looking at applying a GPO that will add SupportAdmin group to the
local admins on all pc's on our network without applying it to the servers.
This would be easily done if out servers were all located under 1 OU, but
they aren't and won't be. I need a way to apply the GPO at the domain level,
but not have it apply to the servers. Is there any good way to accomplish
this?

 

[Guest]

Archived from groups: microsoft.public.win2000.group_policy (More info?)

You could:
Apply a policy and filter it by security group
Maintain a security group of all servers but not PCs.
If you can, find an automated way to maintain the security group of domain
servers.
Anthony

"c0xhealth" <c0xhealth@discussions.microsoft.com> wrote in message
news:BDF5A50D-1CBB-4C07-8789-864F6AB48D64@microsoft.com...
> I work in a hospital that has around 5000 client pc's and around 350
servers.
> We are looking at applying a GPO that will add SupportAdmin group to the
> local admins on all pc's on our network without applying it to the
servers.
> This would be easily done if out servers were all located under 1 OU, but
> they aren't and won't be. I need a way to apply the GPO at the domain
level,
> but not have it apply to the servers. Is there any good way to accomplish
> this?