none
Should a Local Administrator be able to bypass Group Policy Restrictions ?

    Question


  • When a domain account is given local admin privileges on the machine, should this user be able to bypass the group policies imposed by the Domain Administrator ?

    Thanks

    -Tanveer

    Tuesday, December 15, 2015 9:27 AM

Answers

  • > When a domain account is given local admin privileges on the machine,
    > should this user be able to bypass the group policies imposed by the
    > Domain Administrator ?
     
    Yes. Not only he should, but in fact he IS able to get rid of any GPO
    setting.
     
    Tuesday, December 15, 2015 10:37 AM

All replies

  • > When a domain account is given local admin privileges on the machine,
    > should this user be able to bypass the group policies imposed by the
    > Domain Administrator ?
     
    Yes. Not only he should, but in fact he IS able to get rid of any GPO
    setting.
     
    Tuesday, December 15, 2015 10:37 AM
  • Am 15.12.2015 um 10:27 schrieb Mohammed Tanveer:
    > When a domain account is given local admin privileges on the machine,
    > should this user be able to bypass the group policies imposed by the
    > Domain Administrator ?
     
    Sure. He is an admin and an admin is an admin is an admin.
     
    Mark
    --
    Mark Heitbrink - MVP Windows Server - Group Policy
     
    GPO Tool: http://www.reg2xml.com - Registry Export File Converter
     
    Tuesday, December 15, 2015 6:51 PM
  • Hi,

    In my opinion, you could set certain user or computer accounts to deny apply GP.

    For detailed information, you could refer to the article below.

    How to prevent domain Group Policies from applying to certain user or computer accounts

    https://support.microsoft.com/en-us/kb/816100

    Best Regards,

    Jay


    Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Thursday, December 17, 2015 5:41 AM
    Moderator