Domain Admin Rights Supercede a Group Policy on a local machine

  • Thread starter Thread starter David Barter
  • Start date Start date
D

David Barter

If I set up a GPO to restrict any user that sits on a machine in a lab
(like a student biology lab) and a user that has domain admin rights
in my native-mode AD domain trys to use that machine, do those
credentials/rights supercede the GPO on the local machine?
 
if you make the gpo for the computer configuration then it will not. you
must make the gpo on the user config for the domain admin rights to
supercede the GPO

HTH

paul mcGuire
 
GPOs applies in the following order Local => Site => Domain => OU.
GPO processing is based on a last writer wins model, and GPOs that are
processed later have precedence over GPOs that are processed sooner. You can
use No Override (aka Enforced) and Block Inheritance to overcome the default
behavior.

Regards,
/Jimmy
 
Back
Top