Windows Forum

Ask something
Discussion Locked

Group Policy for different users

0 helpful
9 replies

by courtney

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I do not understand why can't get 1 PC to have different settings in Group Policy then the others. I made a separte OU named WinXp, I then made a group in it called WinXp and put 1 PC in it. I then made a new GPO for the WinXP OU and changed my IE home page (as a test).
I then went to the my main domain OU and denyed access to the WinXP group and then for the WinXP GPO I gave read and apply GPO access. On the WinXp GPO I even put Block Policy inhert.
I refresh and restart the D.C> but it still doesn't change. I do not get the new IR page and I still get the settings from the main domain GPO.

I am just trying to set it up so that users or objects in one OU are different and don't inhertite from the other one.

9 replies

by jeaster

Is the policy you are configuring in the user of computer section...what OU is the user a member of that you are logging in as...what GPOs are set for that user?

by shawn

You shouldn't need to play with the permissions too much. The GPO that is "closest" to the intended recipient will be the one who's settings prevail. The policies are applied in the following order:
Site --> Domain --> OU
If a setting in an OU GPO was different from a domain GPO, the OU GPO would be applied.

I would only block access to a particular GPO is there were settings in there that I didn't want touching my users/PCs at all, but you need to be very careful about changing the permissions - otherwise, I'd block inheritance (like you have).

Try changing the permissions back to the default

by courtney

The policy is in the user section of GPO. The User is the only member on the IT Staff OU, Just that user.

All I am looking for is a good document on setting objects in different OU's to have different GPO's that don't inherit from each other.

by courtney

ssimpson@sihi.com
So I did change the permissions back and I set the OU in question to Block inheritance and No override. That seemed to work. Is there any reason I should or should not use NO OVERRIDE

by robcoxon

You do not need to deny access in the main domain OU to WinXP. You need to place the user that you are using to logon with at WinXP in the WinXP OU with apply group policy and read permissions. You may want to create a group with users who should get this policy and add that to the GPO.

This discussion is closed to new replies.