Blocking GP inheritance for admin account on MS TS

[headrush]

I am building a WIN2k server running Terminal Services. I would like to lock down the desktop, control panel, etc, to make it more secure from the users connecting but if I use a computer policy, the admin account's desktop will be locked down as well. I created a OU, created the policy on the OU and placed the Terminal Server in it but how can I block the policy inheritance for the admin account when we log in.

 

[ncotton]

Apply the policy at domain level, and then modify the filters....filter this on SecurityGroups, and remove the Everyone or Authenticated Users entry. Add all groups that you want this policy to apply to.

Hope this Helps.

Neil J Cotton
njc Information Systems
Systems Consultant

 

[headrush]

Is there a way to do it without modifying the default domain policy?

 

[pgaliardo]

Yes, you would be creating a new policy at that level. Don't touch the default policy.

 

[ncotton]

NEVE REDIT DEFAULT DOMAIN POLICY

The only time you should EVER touch the Default Domain Policy is to configure the password policy.

All other settings should be done in a new GPO, I just said link it at domain level.

Hope this Helps.

Neil J Cotton
njc Information Systems
Systems Consultant