GP Overrides user rights

[Paul Cheetham]

Hi,

I have a group of machines that are located on the shop floor of a
manufacturing plant. I have created an OU to contain them, and used a
Group Policy to lock them down and restrict access.
When a domain administrator logs on to one of these machines, the Group
policy is still applied, and they can't do anything. They have to log on
as a local administrator in order to do anything.

Am I missing something here?
There has to be a way of lifting these restrictions when a domain admin
logs in.
(I think the Policy is set in the OU containing the PC's - all the users
are in a different OU)

Thanks for your help.

 

[Brian Desmond [MVP]]

There's definetely a way to prevent the GPO from applying to an admin:

Open up the GPMC or the policies tab for the OU. Find your GPO, goto the
security tab, add domain admins to the list, and tick off Deny for "Apply
Group Policy". This will prevent Domain Admins from applying that particular
policy.

--
--
Brian Desmond
Windows Server MVP
(e-mail address removed)12.il.us

Http://www.briandesmond.com