Deny 'apply policy' to machine?

[Kim Noer]

Hi there ...

On the default group policy I have I've denied 'apply group policy' to
several 'computers'. But I can't get it to work, unless I deny group policy
to the user, currently logged on those computers. How can I workaround this
problem, so that no matter what user that log in on those computers, the
computers does not get the group policy applied?

 

[Glenn L]

rather than an explicit deny, you should remove the authenticated users
group from the apply GPO permission.
You will then have to grants the specific groups you want the GPO to apply
to.

 

[Kim Noer]

rather than an explicit deny, you should remove the authenticated
users group from the apply GPO permission.
You will then have to grants the specific groups you want the GPO to
apply to.

Yes but I'm specifically trying to figure out if you can deny GPO update on
a machine, no matter who the user is and what group this user resides in. If
I chose to remove the authenticated users, and instead add domain users,
then the machine still gets the GPO applied.