GPO exceptions for certain user account

hi,

create gpo affect users except domain/local administrators group. use wmi filter? if so, wmi object should using?

keith

no, make exceptions users wmi filtering not suitable method.

in way the solution depends how ou design looks like.
if target users in in 1 ou can link gpo ou , affect users
within ou. easiest , straight forward approach.
if reason linked gpo domain level, affect user accounts.
to gain more granular control, can use security group filtering on gpo.
there 2 ways:
1. apply group filtering: remove default apply right authenticated users , instead add dedicated custom group
this approach makes sense if smaller part of users in scope of gpo shall receive settings
2. deny group filtering: leave  authenticated users on gpo add a group deny gpo apply oermissions via advanced settings. approach makes sense if the larger part of users in scope of gpo shall receive settings, accounts shall not.

in case i'd choose deny filter (if cannot go ou based solution).

some helpful links:
http://technet.microsoft.com/en-us/library/cc779291(ws.10).aspx
http://technet.microsoft.com/en-us/library/cc781988(ws.10).aspx
http://technet.microsoft.com/en-us/library/cc786636(ws.10).aspx
http://technet.microsoft.com/en-us/library/cc754948(ws.10).aspx

---

patrick

Windows Server  >  Group Policy