none
Prevent GPO from applying to a group of people

    Question

  • Good Morning,

    I have a group of people in a security group called No File Access. I have a GPO that maps printers to users. I want to prevent the GPO from applying to the users in the No File Access security group. I have done the following –

    Gone into Group Policy Management

    Opened the GPO for printer mapping

    Gone into the delegation tab

    Clicked Advanced

    Clicked Add

    Added the No File Access security group

    Scrolled down the list of permissions and ticked Deny next to Apply group policy

    After doing the above steps I have done a gpupdate /force on one of the users machine and then restarted their PC and logged them back in. The printers are still being mapped and the user is still able to print. Is anyone able to explain why this is happening and how I prevent them from being mapped?


    Jeet S

    Friday, June 12, 2015 7:58 AM

Answers

  • Hi everyone,

    I have managed to resolve this. There were two group policy objects that map printers to users computers. One was setup for win 7 computers and the other was setup for XP computers. I had to go through the steps I mentioned in my first post for both gpo's. I had previously only done this on the win 7 gpo. Having done it on both GPO's the printers are now not being mapped for the users in the No File Access security group.


    Jeet S

    • Marked as answer by CLAWWS MCTS Saturday, June 13, 2015 12:16 PM
    Friday, June 12, 2015 9:58 AM

All replies

  • Hi,

    How is this configured in GPO. Are you using GPP to map printers is this configured within User configuration or Computer confirmation section of the GPO?

    Regards,

    Calin

    Friday, June 12, 2015 8:31 AM
  • Hi,

    In drive Mapping there is a tab "Common" . You can check the "Item level targeting" and set the desired security groups in here.

    Ergin

    • Proposed as answer by Arie Heinrich Friday, June 12, 2015 8:50 AM
    Friday, June 12, 2015 8:37 AM
  • Hi,

    I don't understand. Where is "drive mapping" ?


    Jeet S

    Friday, June 12, 2015 9:16 AM
  • Hi Calin,

    I have looked through settings for this particular object and I am unable to see anything in either user or computer config.

    What should I be looking for?


    Jeet S

    Friday, June 12, 2015 9:29 AM
  • Hi everyone,

    I have managed to resolve this. There were two group policy objects that map printers to users computers. One was setup for win 7 computers and the other was setup for XP computers. I had to go through the steps I mentioned in my first post for both gpo's. I had previously only done this on the win 7 gpo. Having done it on both GPO's the printers are now not being mapped for the users in the No File Access security group.


    Jeet S

    • Marked as answer by CLAWWS MCTS Saturday, June 13, 2015 12:16 PM
    Friday, June 12, 2015 9:58 AM
  • you have this wrong somewhere, if you deny read and deny apply group policy through security filtering this should not apply.  You can as suggested you ILT if you wish 
    Friday, June 12, 2015 1:58 PM
  • Hi CLAWWS,

    Do you meanyou just wants to prevent domain Group Policies from applying to certain user in security group No File Access?

    If so, Group Policy objects contain settings that apply to computer objects and to user objects. If you want only to restrict user settings from applying, add only the user account that you do not want the policy settings to apply to. Make sure that the newly-added account is selected in the Group or user names window. Then,  scroll down in the Permissions window, and click to select the Deny check box for the Apply group policy permission.


    https://support.microsoft.com/en-us/kb/816100

    Best Regards,

    Mary Dong



    Saturday, June 13, 2015 6:38 AM
    Moderator
  • Thanks Mary but I am already aware of these steps as you may have read in my very first post in this thread.

    Jeet S

    Saturday, June 13, 2015 12:16 PM