Re: Why doesn't Group Policy work if I put a local group in the affected OU instead of the actual user account?

Group Policies only apply to USER ACCOUNTS and COMPUTER ACCOUNTS ! They don't apply to Group Accounts!
So your experinece was to be expected ;)

You can only filter GPO scope through its DACL to a group (or any individual account).

Claus Greck


"CS" <masssheltie@xxxxxxxxxxx> schrieb im Newsbeitrag news:mWIfl.39265$aG1.22644@xxxxxxxxxxxxxxx
Windows 2003 Server. AD domain. Created an OU so that I can apply a Group Policy to a collection of users. As per Msoft instructions, I created a Local Group, and put that local group inside the OU. Created a Global Group, added users to the Global Group, and then added the Global Group to this local group. I then created a Group Policy - User Config, and set up the restrictions. I applied the GP to the OU, and did a GPUPDATE / FORCE.

The result is that this GP doesn't affect the pc where the user above logs in. If I take the local group out of the OU, and just put the individual user account into the OU (instead of the local group), the GP works fine when that user logs into a PC.

Any ideas why this won't work when I use groups to add users to the OU, and thus to the Global Policy world?

Thanks
CS




.

Relevant Pages

  • RE: Adding AD Account to NT Global
    ... > accounts from other domains while global group is used to be added in other ... The local group in NT is only accessible within the controllers and can't be ... I have already done some successful migrations from nt4 to w2k3 root domain. ...
    (microsoft.public.windows.server.migration)
  • Log on as a service countermeasures
    ... System, Local Service, or Network Service accounts, which have a built ... a built - in local group. ...
    (microsoft.public.security)
  • Re: delegation question....
    ... You have to add all accounts that You want to be a members of the ... administrators local group - in Your specific case I will put the Domain ... Gpo will force this local group membership on all workstations which ... will be under this GPO scope and will put this groups into thel local ...
    (microsoft.public.win2000.active_directory)
  • Re: Why doesnt Group Policy work if I put a local group in the affected OU instead of the actual use
    ... Group policies apply to users and computers, so the accounts has to be ... Security groups you can use with security filtering ... created a Local Group, and put that local group inside the OU. ... Created a Global Group, added users to the Global Group, and then ...
    (microsoft.public.windows.server.security)
  • Re: Why doesnt Group Policy work if I put a local group in the affected OU instead of the actual use
    ... Group policies apply to users and computers, so the accounts has to be member of that OU, Security groups you can use with security filtering with GPMC. ... created a Local Group, and put that local group inside the OU. ... Created a Global Group, added users to the Global Group, and then ...
    (microsoft.public.windows.server.security)