Announcement

Collapse
No announcement yet.

GPO users

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • GPO users

    Ok so I need an example here, not really searching for anything critical. I am just wondering why User GPOs run with that users Credentials instead of system, or something else (specifically logon scripts). It isn't like the users can change the GPO and give themselves permissions or access or anything, so why restrict it like that?

    I am not trying to be sarcastic, but wondering why you would make a GPO run as a restricted user and not give any options to run as an administrator type. It seems backwards to me.

    Thanks!
    Two things:
    1) If I wrote something wrong please please please let me know. I want to know ESPECIALLY if I am wrong.
    2) I have a tendency to write things that are misconstrued as being agressive or not so pleasant. That is not my intent.

  • #2
    Re: GPO users

    I'm trying to understand what you are asking here. what do you mean user GPOs running as Users credentials? Can you give a specific example?

    GPOs is applied to domain users/computers by domain controller and and settings override local settings. It use the domain trust from DC and Domain Users/Computers.

    Comment


    • #3
      Re: GPO users

      As mentioned, can you give an example as there is the ability to run some GPOs with elevated permissions or as the user including GP preferences depending on the settings.

      Comment


      • #4
        Re: GPO users

        Logon scripts? Like I said above. When you apply a logon script to a user via gpo it runs with the users credentials, which makes no sense to me. Its not like a no priveledge user can change the gpo and give themselves access to things that the admin doesn't want them to have access to.

        I am sure there is a good reason to do it that way, but I am having a hard time wrapping my little pea brain around why a GPO would ever run with restricted credentials, or why you would even want one to.

        Just one of the many posts about this:

        http://social.technet.microsoft.com/...um=winserverGP
        Two things:
        1) If I wrote something wrong please please please let me know. I want to know ESPECIALLY if I am wrong.
        2) I have a tendency to write things that are misconstrued as being agressive or not so pleasant. That is not my intent.

        Comment

        Working...
        X