group policy

  • Thread starter Thread starter Staffan
  • Start date Start date
S

Staffan

If I add a group into a OU and try to set group policy it
does not get any affects. But if I put single user in the
same OU and set group policy the user will be touch of the
policy.

Do someone know how to do??
 
Group policies only apply to user and computer accounts. They will not
apply to groups within the OU. You can use groups to filter group policies.
The following article discusses how. 322176 HOW TO: Administer GPO
Properties in Windows 2000 http://support.microsoft.com/?id=322176


--
Tim Hines, MCSE, MCSA
Windows 2000 Directory Services

=====================================================
When responding to posts, please "Reply to Group" via
your newsreader so that others may learn and benefit
from your issue.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.
 
Hi Staffan,

What type of group are you referring to? There maybe an existing filter on
the group you are trying to apply the policy to.
In the Permissions windows, click to select the Deny check box for the Apply
Group Policy permission. This prevents the group policy object from being
accessed and applied to the selected group.
KBLink:293655.KB.EN-US: How to Apply Local Policies to all Users Except
Administrators

I hope this helps
 
-----Original Message-----
If I add a group into a OU and try to set group policy it
does not get any affects. But if I put single user in the
same OU and set group policy the user will be touch of the
policy.

Do someone know how to do??


.
Click to expand...
Staffan,

You can not apply a group policy to a security group.
This is a very common mistake that a whole lot of people
make. You must apply the GPO to an Organizational Unit.
The only role that a security group plays in this whole
procedure is if you use one to filter to whom the policy
applies.

For example, say that you have an OU filled with 10 user
accounts ( user01, user02, user03, etc. etc. ). Let's
just say that you have applied a GPO to this OU so that
the 10 user accounts located in it get Office 2000
Advanced Assigned to the User Configuration (
furthermore, you make use of an .mst file so that these
10 user accounts have a very specific Office 2000 setup ).

Now, you have another application that needs to be
deployed and you would like to make use of a GPO as it
has a native .msi file! However, of the 10 user accounts
in this OU only seven will need this application. So,
you create the GPO ( remember to disable it while you are
creating it and once you are finished to enable it ) and
apply it to that OU with the 10 user accounts. Remember,
only seven of the user accounts need it. So, you create
a Global Security Group and make those seven user
accounts a member of that Global Security Group. You
then go to the Security Tab on the GPO itself and
remove 'Authenticated Users' and replace it with that
Global Security Group. Give it both the "Read"
and "Apply Group Policy" rights and you are good to go.
Although there are 10 user accounts in the OU and the
application has been applied to that OU for deployment
via GPO only the seven user accounts which are a member
of the Global Security Group will receive the
Application. The other three user accounts will not be
affected by that particualr GPO.

HTH,

Cary

PS You also need to make sure that you supply a UNC path
to the .msi file!
 
Back
Top