none
disable usb so how to exclude few users

    Question

  • I have enforced a GPO policy e.g. disable usb so how to exclude few users? Need to create security group add exclude users select deny it will work? Or need to go with block inheritance

    Saturday, July 04, 2015 4:37 AM

Answers

  • Hi aburmila,

    You don't have to create 2 GPOs to meet your requirement. You can create just one GPO and go to user configuration>>Administrative Templates>>System Removable Storage access>> All removable storage classess: deny all access>> enabled.

    Link the gpo to the related user account OU and then you can use the scurity filtering or delegation tab to filter out the specific users. A user must have the read and apply permission on the gpo then he might able to apply this gpo setting. Otherwise, he would not able to apply the gpo.

    You can check below article for more references to know about the security filtering and gpo delegation:

    https://technet.microsoft.com/en-us/library/cc781988(v=ws.10).aspx

    https://msdn.microsoft.com/en-us/library/aa373513%28v=vs.85%29.aspx?f=255&MSPPError=-2147217396

    Best Regards,

    Elaine


    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Tuesday, July 07, 2015 7:29 AM
    Moderator

All replies