Re: Spying in a corporate environment

"However, while being logged into the local machine instead of the domain
domain policies are not re-applied. An administrator can now manually
change/remove those policies"

This is still incorrect- though I must admit that you made me second guess myself. I actually just tested it with the Windows Firewall policy I mentioned below. :) An administrator does NOT have the ability to manually change/remove the applied policies; local administrator can modify the local machine policy, but it will not be enforced until policy is updated, at which point the domain policies override the local policy settings.


On Fri, 23 Nov 2007, Ansgar -59cobalt- Wiechers wrote:

On 2007-11-23 Big Joe Jenkins wrote:
On Thu, 22 Nov 2007, Ansgar -59cobalt- Wiechers wrote:
Like I said before: they log into the local machine instead of
logging into the domain. Voil, no domain policies applied.

This is absolutely not true and displays a fundamental
misunderstanding of group policy application. As long as the
workstation in question is in a site/domain/OU with computer targetted
GPO settings linked to it, these GPOs will apply to the machine
regardless of how a user logs in.

For example, I've created a Windows Firewall GPO that propagates
restrictive Windows firewall settings to clients. This is a computer
targetted GPO that is applied to security groups composed of
workstation accounts. When a user (including local administrator) logs
in locally to one of the workstations specified in the GPO's
filtering, the policy is applied and local administrator is unable to
modify any Windows firewall settings (their only recourse would be to
remove the workstation from the domain).

Please try this- log in as local administrator to a workstation as
specified above, and run gpresult or rsop and view the results.

Poor wording on my part. Sorry about that.

Of course the policies that were applied to the machine once aren't
magically removed just because the user logs into the local machine
instead of the domain.

However, while being logged into the local machine instead of the domain
domain policies are not re-applied. An administrator can now manually
change/remove those policies. At least AFAICS. Someone correct me if I'm
wrong.

Regards
Ansgar Wiechers
--
"The Mac OS X kernel should never panic because, when it does, it
seriously inconveniences the user."
--http://developer.apple.com/technotes/tn2004/tn2118.html


Relevant Pages

  • Re: Managing Group Policy on XP SP2
    ... SP2 policy--specifically those two Windows Firewall policies: ... MS-MVP-Windows Server--Group Policy ... Check out http://www.gpoguy.com -- The Windows Group Policy Information Hub: FAQs, Whitepapers and Utilities for all things Group Policy-related "d mac" wrote in message ... >>> policies are missing. ...
    (microsoft.public.win2000.group_policy)
  • Group Policy questions
    ... overwritten by the Default Domain Group Policy. ... special policies on them. ... When a machine joins the domain, is its local machine ... Is there a way to turn off the Default Domain Group ...
    (microsoft.public.windows.server.active_directory)
  • Re: policy confusement
    ... Local machine policies are loaded first, and if no other policy ... > overrides these policies take control for only the local computer. ... But in case the local machine is the DC, these policies have the same effect ...
    (microsoft.public.win2000.networking)
  • RE: power managment
    ... Unfortunately the actual Policy is Binary, but if you create the policy ... you want on your local machine, and then duplicate the registry entries, you ... Policies REG_BINARY Value ... After 30 mins. ...
    (microsoft.public.windows.server.scripting)
  • Re: SBS 2008 - "Exchange E-Mail address policy cannot be configured"...
    ... I verified all of that and do not see any policies that would cause ... Check Exchange 2003 policies" part of the following SBS ... " The Exchange E-mail address policy cannot be configured. ... ONLY Mailbox Manager policies and do not define e-mail addresses ...
    (microsoft.public.windows.server.sbs)
Loading