group policy

[Hansen]

how can i override the default domain policy for computer configuration
setting ?

i have made an OU, in which I have a user and a computer account. I linked
my GPO to the OU.

running rsop i found out that on user configuration my gpo is applied as
well as the default domain policy (my gpo won). but on computer
configuration only default domain policy is applied.

am i missing something ?

thanks for the help

hansen

 

[Guest]

check the computer group policy and the user group policy
within your new GPO (computer group policy applies to
computers in that GPO only but it will always overide the
user policy), also check for inheretence from the default
policy, if its not blocked then block it.

 

[Hansen]

hi,

no, i dont mean that the computer config setting override the user config
setting in my new gpo. it is that the new gpo (computer config part ) isnt
applied to the computer within the container.

i dont want to block the default domain policy if possible.
isnt the gp application as follow :
site gpo -> domain gpo -> ou gpo
so if i have my gpo linked to the ou wouldnt it override both site and
domain gpo by itself without any blocking ?

hansen

 

[ptwilliams]

It'll only override conflicts. If you configure some settings at the domain
level and then different settings at the OU level both will be applied.
Only conflicting settings are actually overridden - everything else is
cumulative.

If the computer configuration part of the OU-linked GPO isn't processing,
check to ensure that you haven't disabled the computer configuration part of
the GPO. I often configure my OU-linked GPOs to only process one of the two
sets of settings, i.e. user.

If you don't want to process the DDP then you can set the OU-linked GPO to
use Block Inheritance, or you could filter certain members via a security
group and the deny process policy permission on the policies DACL.


--

Paul Williams
_________________________________________
http://www.msresource.net


Join us in our new forums!
http://forums.msresource.net
_________________________________________


hi,

no, i dont mean that the computer config setting override the user config
setting in my new gpo. it is that the new gpo (computer config part ) isnt
applied to the computer within the container.

i dont want to block the default domain policy if possible.
isnt the gp application as follow :
site gpo -> domain gpo -> ou gpo
so if i have my gpo linked to the ou wouldnt it override both site and
domain gpo by itself without any blocking ?

hansen