none
Deny specific setting in GPO

    Question

  • Hi Experts,

    I want to know is it possible to deny a specific setting in gpo on a user or group of users.

    Thank You.


    TechSpec90

    Monday, February 16, 2015 5:59 AM

Answers

  • Thank You for the reply,

    I have visited the above links but the method mentioned in the links will going to deny the whole group policy on a single user or group, I want to know is it possible to deny a "specific setting" in a gpo on a certain user or group


    TechSpec90


    Depending on the nature of the setting, if that setting is available via GP-Preferences, you could use Item-Level-Targeting (ILT can be configured to "filter" or "target" a setting within a GP-Preferences GPO.

    Or, another way is to create another GPO, so that only that particular setting is not-set, or whatever you want, and then use Security Filtering on that copy of the GPO to apply it to the desired user/group, and then configure that GPO to have higher or lower precedence (compared to the original GPO), and link the new GPO to the same OU.


    Don
    (Please take a moment to "Vote as Helpful" and/or "Mark as Answer", where applicable.
    This helps the community, keeps the forums tidy, and recognises useful contributions. Thanks!)

    • Marked as answer by techspec90 Wednesday, February 18, 2015 5:07 AM
    Monday, February 16, 2015 10:20 AM

All replies

  • Thank You for the reply,

    I have visited the above links but the method mentioned in the links will going to deny the whole group policy on a single user or group, I want to know is it possible to deny a "specific setting" in a gpo on a certain user or group


    TechSpec90

    Monday, February 16, 2015 6:21 AM
  • Hello,

    No, it is not possible.

    Regards

    Monday, February 16, 2015 6:35 AM
  • Thank You for the reply,

    I have visited the above links but the method mentioned in the links will going to deny the whole group policy on a single user or group, I want to know is it possible to deny a "specific setting" in a gpo on a certain user or group


    TechSpec90


    Depending on the nature of the setting, if that setting is available via GP-Preferences, you could use Item-Level-Targeting (ILT can be configured to "filter" or "target" a setting within a GP-Preferences GPO.

    Or, another way is to create another GPO, so that only that particular setting is not-set, or whatever you want, and then use Security Filtering on that copy of the GPO to apply it to the desired user/group, and then configure that GPO to have higher or lower precedence (compared to the original GPO), and link the new GPO to the same OU.


    Don
    (Please take a moment to "Vote as Helpful" and/or "Mark as Answer", where applicable.
    This helps the community, keeps the forums tidy, and recognises useful contributions. Thanks!)

    • Marked as answer by techspec90 Wednesday, February 18, 2015 5:07 AM
    Monday, February 16, 2015 10:20 AM
  • Thank You DonPick

    I'll apply your suggestion and update here..

    Thank You.


    TechSpec90

    Monday, February 16, 2015 10:26 AM
  • Hi 

    You can use delegation and filtering feature in the GPMC 

    Thanks

    Monday, February 16, 2015 11:49 AM
  • Delegation and filtering feature will going to deny the whole GPO on a user or group  but not a specific setting in the GPO, I am looking for a solution for that....

    TechSpec90

    Monday, February 16, 2015 12:10 PM