none
Do not apply user settings to computer group

    Question

  • I'm in the process of trying to consolidate our old GPO list, and so I've setup a GPO that is, by default, applied to all users which will lockout a computer after 5 minutes of inactivity. I have permissions set for a particular user group to not apply this GPO. What I need to do is have a certain group of computers also deny applying this GPO, regardless of the user who logs into it. Would this be a matter of simply using "Deny Apply Group Policy" like the user group, only to a computer group? Or will it require additional settings or a separate GPO? Any help is appreciated.
    Wednesday, June 08, 2016 6:08 PM

Answers

  • Hi Justin,

    Thanks for your post.

    To achieve your goal, you could use group policy loopback mode.

    This policy directs the system to apply the set of Group Policy objects for the computer to any user who logs on to a computer affected by this policy. It is intended for special-use computers, such as those in public places, laboratories, and classrooms, where you must modify the user policy based on the computer that is being used.

    For more information, you could refer to the article below.

    Windows Server: Understand “User Group Policy Loopback Processing Mode”

    http://social.technet.microsoft.com/wiki/contents/articles/2548.windows-server-understand-user-group-policy-loopback-processing-mode.aspx

    Best Regards,

    Jay


    Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Thursday, June 09, 2016 2:11 AM
    Moderator
  • > simply using "Deny Apply Group Policy" like the user group, only to a
    > computer group? Or will it require additional settings or a separate
    > GPO? Any help is appreciated.
     
    Loopback is the "traditional" way for this requirement, but there's more
    than one way to skin a cat :-)
     
     
    Thursday, June 09, 2016 7:59 AM

All replies

  • Hi Justin,

    Thanks for your post.

    To achieve your goal, you could use group policy loopback mode.

    This policy directs the system to apply the set of Group Policy objects for the computer to any user who logs on to a computer affected by this policy. It is intended for special-use computers, such as those in public places, laboratories, and classrooms, where you must modify the user policy based on the computer that is being used.

    For more information, you could refer to the article below.

    Windows Server: Understand “User Group Policy Loopback Processing Mode”

    http://social.technet.microsoft.com/wiki/contents/articles/2548.windows-server-understand-user-group-policy-loopback-processing-mode.aspx

    Best Regards,

    Jay


    Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Thursday, June 09, 2016 2:11 AM
    Moderator
  • > simply using "Deny Apply Group Policy" like the user group, only to a
    > computer group? Or will it require additional settings or a separate
    > GPO? Any help is appreciated.
     
    Loopback is the "traditional" way for this requirement, but there's more
    than one way to skin a cat :-)
     
     
    Thursday, June 09, 2016 7:59 AM