Exempting OU from GPO

[Victor Fisher]

Greetings,

I have a default domain policy that runs a login script, among other
things. I'm applying a 2nd GPO to a SITE (a specific subnet) to run a
2nd logon script. This works great... any computer in this subnet
gets this script and it runs after my initial script. However, I
would like to exempt certain computers in this subnet from running the
script. I've moved each of these computers to its own OU, added them
to a security group and linked the GPO to the OU. I then denied AGP
on the security group I've created. However, this does not stop the
script from running.

What am I missing?

Thanks for your help.

 

[Derek Melber [MVP]]

you need to deny AGP permission at the GPO linked to the site.