exclude admin account in domain ou

[Flint]

If I have settings in the domain OU that I want to exclude the administator
account, what's the best way of doing that? Putting the admin account in
it's own OU doesn't seem to work as the domain OU is overridding any
settings on the newly created OU.

Thanks.

 

[chriske911]

Flint presented the following explanation :

If I have settings in the domain OU that I want to exclude the administator
account, what's the best way of doing that? Putting the admin account in
it's own OU doesn't seem to work as the domain OU is overridding any settings
on the newly created OU.

Thanks.

1) "block policy inheritance"

2) create a GPO where you explicitly alter settings you desperately
need acces to

3) do not set a top GPO to strict and create second top level OU's to
do your bussiness in

4) use filtering on base of group membership

grtz