Domain Admin Rights Supercede a Group Policy on a local machine

[David Barter]

If I set up a GPO to restrict any user that sits on a machine in a lab
(like a student biology lab) and a user that has domain admin rights
in my native-mode AD domain trys to use that machine, do those
credentials/rights supercede the GPO on the local machine?

 

[Matjaz Ladava [MVP]]

Domain GPO's always override local computer policies.

--
Regards

Matjaz Ladava, MCSE (NT4 & 2000), Windows MVP
(e-mail address removed)
http://ladava.com

 

[Paul McGuire]

if you make the gpo for the computer configuration then it will not. you
must make the gpo on the user config for the domain admin rights to
supercede the GPO

HTH

paul mcGuire

 

[Jimmy Andersson]

GPOs applies in the following order Local => Site => Domain => OU.
GPO processing is based on a last writer wins model, and GPOs that are
processed later have precedence over GPOs that are processed sooner. You can
use No Override (aka Enforced) and Block Inheritance to overcome the default
behavior.

Regards,
/Jimmy