Users who are members of groups a in different ou's

[Guest]

I have a question about users and Group policy.
Imagine i have two Ou's the first being "Alpha" and the second being "Beta". User "Bob's" account resides in "Alpha" Ou
"Bob" is a member of a group called "Managers". The "Managers" account has been added to the "Beta" OU
A group policy is applied to Both OU's and a user policy is set, lets say for example we have configured the policy to disabl
the settings tab on "display properties". Bob Logs on and the policy is applied. We then change the setting, to display the setting tab in display properties, but this is set only on the "Alpha" OU, group policy. The "Beta" OU policy is still configured to disable it. What is the outcome of the two policies, which will will be applied and why?

 

[Richard McCall [MSFT]]

The Beta policy will not apply to Bob so the setting tab will be displayed.
Security Groups do not trigger group policy to apply. They can be used where
a Machine account is in the Beta OU and you enable loopback processing on
the policy that applies to the machine. At this point you can use the
security group to allow\prevent the user configuration of the group policy
on the Beta OU to apply to users who log in to the machines in the OU.
Regardless of where there user account is. This is usually good for Terminal
servers and workstation that will be accessed by users from a trusted
domain.

--
Richard McCall [MSFT]

"This posting is provided "AS IS" with no warranties, and confers no
rights."

I have a question about users and Group policy.
Imagine i have two Ou's the first being "Alpha" and the second being

"Beta". User "Bob's" account resides in "Alpha" Ou.

"Bob" is a member of a group called "Managers". The "Managers" account has been added to the "Beta" OU.
A group policy is applied to Both OU's and a user policy is set, lets say

for example we have configured the policy to disable

the settings tab on "display properties". Bob Logs on and the policy is

applied. We then change the setting, to display the setting tab in display
properties, but this is set only on the "Alpha" OU, group policy. The "Beta"
OU policy is still configured to disable it. What is the outcome of the two
policies, which will will be applied and why?

 

[Gary Mudgett [MSFT]]

Policies are applied to the actual location of the user/computer account and
is not based on where groups are located that the user is a member of.

In your example Bob would get the policy from the Alpha OU because that is
where his account resides.

--
Gary Mudgett, MCSE, MCSA
Windows 2000/2003 Directory Services

=====================================================
When responding to posts, please "Reply to Group" via
your newsreader so that others may learn and benefit
from your issue.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

I have a question about users and Group policy.
Imagine i have two Ou's the first being "Alpha" and the second being

"Beta". User "Bob's" account resides in "Alpha" Ou.

"Bob" is a member of a group called "Managers". The "Managers" account has been added to the "Beta" OU.
A group policy is applied to Both OU's and a user policy is set, lets say

for example we have configured the policy to disable

the settings tab on "display properties". Bob Logs on and the policy is

applied. We then change the setting, to display the setting tab in display
properties, but this is set only on the "Alpha" OU, group policy. The "Beta"
OU policy is still configured to disable it. What is the outcome of the two
policies, which will will be applied and why?

 

[Chriss3]

Here is few links I will add to what Richard and Gary says with articles and
papers to understand Group Policy

Understand Group Policy
http://www.microsoft.com/technet/tr...dows2000serv/reskit/distsys/part4/dsgch22.asp

Group Policy Best Practices:
http://www.microsoft.com/windows2000/en/server/help/sag_sp_bestprac.htm
--
Regards,

Christoffer Andersson
No email replies please - reply in the newsgroup
If the information was help full, you can let me know at:
http://www.itsystem.se/employers.asp?ID=1

I have a question about users and Group policy.
Imagine i have two Ou's the first being "Alpha" and the second being

"Beta". User "Bob's" account resides in "Alpha" Ou.

"Bob" is a member of a group called "Managers". The "Managers" account has been added to the "Beta" OU.
A group policy is applied to Both OU's and a user policy is set, lets say

for example we have configured the policy to disable

the settings tab on "display properties". Bob Logs on and the policy is

applied. We then change the setting, to display the setting tab in display
properties, but this is set only on the "Alpha" OU, group policy. The "Beta"
OU policy is still configured to disable it. What is the outcome of the two
policies, which will will be applied and why?