Group Policy Management - Deny User Configuration by Computer name

hello,

i've configured group policy defines program run under
user configuration, policies, windows settings, scripts, logon

trying prevent gpo/script running on specific machines(two terminal servers). have added machines group(as ou) , denied read permissions, seems restrict computer configuration applying. added deny permissions specific user, , sure enough gpo not applied - i'm guessing deny/allow permissions pertain type of configuration being applied per gpo. searched few other threads , else seems trying allow machine name(loopback work around here), or find other way needed. not sure go here?

thank you,

skitchin

well, found work around, rather not way if there better option. created .bat file run gpo instead, bat file checks see if %computername% matches 1 of excluded machine names, , runs app if not.

if not %computername%==server1 (
 if not %computername%==server2 (
  start someapp.exe /someparam somesetting
 )
)

interesting there no item level targeting can find specific setting, seems need ~_~

Windows Server  >  Group Policy