Announcement

Collapse
No announcement yet.

Any way to temporarily disable GPO

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • Any way to temporarily disable GPO

    Greetings,

    I've GPO that restrict the access to Internet Connection in IE, disable access to RUN and CMD.

    So is there any way to temporarily disable the GPOs for 15 min then automatically applied them again like adding the user to group with no policy.

    Regards,

  • #2
    Re: Any way to temporarily disable GPO

    Can you confirm whether you wanna to restrict this GP setting for specific user or all users.

    Comment


    • #3
      Re: Any way to temporarily disable GPO

      Originally posted by malefactor40 View Post
      Greetings,

      I've GPO that restrict the access to Internet Connection in IE, disable access to RUN and CMD.

      So is there any way to temporarily disable the GPOs for 15 min then automatically applied them again like adding the user to group with no policy.

      Regards,
      Not really.

      You can move the user to an OU and block inheritance which will not give them any GPO's. You will however need to create a GPO to reverse the changes that were made in the original GPO.

      AFAIK this would all need to be done manually.

      Can I ask the reason why you want this to be done?

      Comment


      • #4
        Re: Any way to temporarily disable GPO

        Would he need a GPO to reverse the changes or just delete the local user profile after the first GPO is no longer applied?

        Comment


        • #5
          Re: Any way to temporarily disable GPO

          Originally posted by Bertmax View Post
          Would he need a GPO to reverse the changes or just delete the local user profile after the first GPO is no longer applied?
          You could try deleting the user profile but depending on the changes made there could be locations in the registry that are tattooed with the GPO requirements.

          This is the reason I mentioned creating a GPO with the entries reversed.

          Comment


          • #6
            Re: Any way to temporarily disable GPO

            Well, it would be easy enough to distinguish: if the changes were made under the User Configuration, deleting the profile would work.

            Comment


            • #7
              Re: Any way to temporarily disable GPO

              Originally posted by lisa804u View Post
              Can you confirm whether you wanna to restrict this GP setting for specific user or all users.
              Only for specific user.


              Originally posted by wullieb1 View Post
              Not really.

              You can move the user to an OU and block inheritance which will not give them any GPO's. You will however need to create a GPO to reverse the changes that were made in the original GPO.

              AFAIK this would all need to be done manually.

              Can I ask the reason why you want this to be done?
              The reason that we have two applications that have to be installed from the user profile with full privilege in order to configure database then return the user under policy to work normally on the applications.



              Originally posted by Bertmax View Post
              Well, it would be easy enough to distinguish: if the changes were made under the User Configuration, deleting the profile would work.
              Still the user profile is needed since the user has to has the GPO applied again after installation and configuration complete.

              ******
              I've worked in a company that has what I'm looking for which is adding users to Security group which will lead to remove the restrictions for 30 minutes then the users will be automatically removed from this security group. so after the 30 minutes the restrictions will be applied again. But unfortunately at that time I was not responsible about AD.
              Last edited by malefactor40; 26th April 2014, 08:55. Reason: adding comment

              Comment


              • #8
                Re: Any way to temporarily disable GPO

                Originally posted by malefactor40 View Post
                ******
                I've worked in a company that has what I'm looking for which is adding users to Security group which will lead to remove the restrictions for 30 minutes then the users will be automatically removed from this security group. so after the 30 minutes the restrictions will be applied again. But unfortunately at that time I was not responsible about AD.
                I've never heard of such happening but that's not to say that it isn't available.

                What you may find is that it is a manual process of adding a user to a group that could potentially have GPO's blocked for that specific Security group. Removing the user from that group would then remove the block.

                Comment


                • #9
                  Re: Any way to temporarily disable GPO

                  Originally posted by malefactor40 View Post
                  Still the user profile is needed since the user has to has the GPO applied again after installation and configuration complete.
                  The user profile will be recreated upon the user's next logon, with only the restrictions set out by the new policy, and none from the old.

                  The only reason to hang on to a local user profile is if they store their documents there (which isn't good practice). They can always redo their Windows customizations.

                  Comment


                  • #10
                    Re: Any way to temporarily disable GPO

                    Originally posted by Bertmax View Post
                    They can always redo their Windows customizations.
                    If I remove my profile it would take me around a day of messing about to get it the way I had it before. Can your users lose that amount of time?

                    IMHO deleting a user profile is the last thing I want to do unless I really need to.

                    Comment


                    • #11
                      Re: Any way to temporarily disable GPO

                      When I was a sys admin (and actually had users), user documents and Favorites were stored on a server via folder redirection in every case. In the schools, the desktop and start menu were also redirected to a file server, so deleting the user profile was not an issue. In fact, it came in rather handy when dealing with profile-specific issues, and for when we decided to change a GPO.

                      Of course, this was a public school district and some things had to be marginalized for the sake of support. We had one sys admin (moi) and about 10 network analysts supporting a school district of ~5,000 employees and over 30,000 students. Not everyone got to set up their desktops the way they wanted.

                      Comment

                      Working...
                      X