none
GPO - Exclusion group to GPO - not working!

    Question

  • Hi,

    I have created a gpo successfully which blocks saving to desktop/my documents. This is done by using a vbs. i have followed these steps to create an exclusion group for the GPO:

    http://www.grouppolicy.biz/2010/05/how-to-exclude-individual-users-or-computers-from-a-group-policy-object/

    Now, this does not work, picks up the policy etc. Is it because its a vbs? Shouldnt make a difference really. Any help appreciate, also this is quite urgent!

    2008 R2/Windows 7 SP1

    Friday, January 29, 2016 4:48 PM

Answers

  • Generate a gpresult report and you will see how the user gets the GPO. If what you try to enforce is a computer setting while you exclude users, the exclusion is not applicable.

    As a side note, try to use a well designed OU structure for better GPO targeting instead of using exclusion or security filtering. Exceptions are hard to rememeber/troubleshooting.

    Friday, January 29, 2016 8:15 PM

All replies

  • Generate a gpresult report and you will see how the user gets the GPO. If what you try to enforce is a computer setting while you exclude users, the exclusion is not applicable.

    As a side note, try to use a well designed OU structure for better GPO targeting instead of using exclusion or security filtering. Exceptions are hard to rememeber/troubleshooting.

    Friday, January 29, 2016 8:15 PM
  • That website made a FUNNY!!!! bwahahahahahahahahhaa.

    oh, that is classic.

    Go to the first tab, 'Scope'. use links to filter by OU. Use security Filtering to filter by computer/user/usergroup.

    Friday, January 29, 2016 8:20 PM
  • security filtering gives you only "inclusion" type of targeting, not exclusion.
    Sunday, January 31, 2016 3:36 AM
  • >>Now, this does not work, picks up the policy etc.
     
    I don't quite understand this, you mean this exclusion doesn't work or the entire GPO doesn't work any more?
     
    Please share more details about your GPO settings and how exactly you deployed it. It will be helpful for us to troubleshoot the issue.
     
    >That website made a FUNNY!!!!
     
    Not exactly. That's how we exclude individual users or computers from a Group Policy Object.
     

    Regards,

    Ethan Hua


    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com

    Monday, February 1, 2016 7:37 AM
    Moderator