Announcement

Collapse
No announcement yet.

applying group policy to a specific user or a group

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • applying group policy to a specific user or a group

    hii

    im have one PC running win Xp pro SP2.
    I have created some users and 2 groups.

    Im wondering how can i apply group policy to a specific user or a group.

    whenver i make changes in group policy editor under user configuration it only applies to whole users include administrators ( ex, hiding desktop icons )

    is there any way to do this or its impossible? and please let me know how to do that if its possible.

    Note: we have only one pc, no AD environment.

    thanks in advance..

  • #2
    Re: applying group policy to a specific user or a group

    I answered you over at Security-Forums.com in this thread... but for the edification of others on this forum and the interwebs at large, I'll copy and paste it here:

    ---
    In Windows XP you can only apply items in the "computer configuration >> windows settings >> security settings" node to different users on a workgroup machine. You cannot apply other GPO items to specific users on a workgroup computer.

    Vista changes that with a thing called MLGPOs (Multiple Local GPOs). Your only option is to upgrade to Vista.
    ---
    Wesley David
    LinkedIn | Careers 2.0
    -------------------------------
    Microsoft Certifications: MCSE 2003 | MCSA:Messaging 2003 | MCITP:EA, SA, EST | MCTS: a'plenty | MCDST
    Vendor Neutral Certifications: CWNA
    Blog: www.TheNubbyAdmin.com || Twitter: @Nonapeptide || GTalk, Reader and Google+: [email protected] || Skype: Wesley.Nonapeptide
    Goofy kitten avatar photo from Troy Snow: flickr.com/photos/troysnow/

    Comment


    • #3
      Re: applying group policy to a specific user or a group

      thanks again , great help..

      Comment


      • #4
        Re: applying group policy to a specific user or a group

        Unless I am missing something from the OPs request then, In a Local GPO if it is a Computer Configuration setting, there is nothing you can do as it'll apply to whoever logs into that computer.

        But if it is a User Configuration section then you can go to the GroupPolicy folder in C:\Windows\System32 and go to the security tab. In there you can add the local user account or Group and assign them the Deny Read & Execute permission. That way the GP settings from the User section will not apply to that user or group.
        Somewhat a similar principle as the Security filtering in a Domain GPO
        That will prevent the policy from applying to them.

        Cheers
        Caesar's cipher - 3

        ZKHQ BRX HYHQWXDOOB GHFLSKHU WKLV BRX ZLOO UHDOLVH LW ZDV D ZDVWH RI WLPH!

        SFX JNRS FC U6 MNGR

        Comment


        • #5
          Re: applying group policy to a specific user or a group

          Let's be clear about terminology here... "Group Policy" is an Active Directory Domain feature... there is no such thing as "Group Policy" on a stand-alone workstation. Microsoft were IMO foolish when they allowed the "Group Policy" MMC snap-in to also access local policies.

          AFAIK the thread starter is asking about "Local Policy"... and these are not done using "Policy Objects" like GPOs are. There is one set of User Policies and one set of Computer Policies; there is also a "Local Security Policy". You cannot filter these individually by user or group - but as L4ndy says you can prevent ALL policies applying to a particular user/group... but this is not sufficiently granular for most purposes.


          Tom
          For my own and your protection, I do not provide support by private message under any circumstances. All such messages will be deleted and ignored.

          Anything you say will be misquoted and used against you

          Comment


          • #6
            Re: applying group policy to a specific user or a group

            Yes Tom it's true that those terms can be quite confusing some times.
            That's why I was specificaly referring to Local Group Policies (LGP).
            Although I'd have to correct you slightly if I may. I said that you can filter only the User configuration policies by editing the ACL on the GroupPolicies folder.
            This sort of "Filtering" won't affect any policies based on the computer configuration section.

            Ta
            Caesar's cipher - 3

            ZKHQ BRX HYHQWXDOOB GHFLSKHU WKLV BRX ZLOO UHDOLVH LW ZDV D ZDVWH RI WLPH!

            SFX JNRS FC U6 MNGR

            Comment


            • #7
              Re: applying group policy to a specific user or a group

              Originally posted by L4ndy View Post
              But if it is a User Configuration section then you can go to the GroupPolicy folder in C:\Windows\System32 and go to the security tab. In there you can add the local user account or Group and assign them the Deny Read & Execute permission. That way the GP settings from the User section will not apply to that user or group.
              Somewhat a similar principle as the Security filtering in a Domain GPO
              That will prevent the policy from applying to them.

              Cheers
              ::slaps forehead::

              I always forget about that NTFS security hack to block a user policy from applying to the admin account and this creating in effect a second user policy for another account. London77, do you think this will be sufficient for your purposes?
              Wesley David
              LinkedIn | Careers 2.0
              -------------------------------
              Microsoft Certifications: MCSE 2003 | MCSA:Messaging 2003 | MCITP:EA, SA, EST | MCTS: a'plenty | MCDST
              Vendor Neutral Certifications: CWNA
              Blog: www.TheNubbyAdmin.com || Twitter: @Nonapeptide || GTalk, Reader and Google+: [email protected] || Skype: Wesley.Nonapeptide
              Goofy kitten avatar photo from Troy Snow: flickr.com/photos/troysnow/

              Comment


              • #8
                Re: applying group policy to a specific user or a group

                You can temporally make the user part of administrator group,edit the user configuration of group policy to the specified user and than remove the user from administrator group.

                Comment

                Working...
                X