Copy Group Policy

[kkiedrowski]

I am finally getting around to setting up OU's on our 2000 server. now for the group policy pretty much they are all going to be the same except for a few changes based on OU. Is there an easy way to copy an exiting policy and its setting to a new one?

 

[soundguy]

There is no need to copy a grou policy.

Once you have created a group policy, you have created it for the domain, you can then assign the group policy to any existing OU within the domain.

Use the ADD button to add a GP to the OU.

 

[kkiedrowski]

the reason i want to copy is for example: group a i want to restrict access to internet explorer menus
for group b i do not.
the one group policy effects all OU's the same. I need different policies

 

[mozingod]

Put all the users you want restricted from it in an OU, and assign that GPO to that OU. Or assign it to a whole site, and select the OU's you don't want it to affect, and enable the "Block policy inheritence" option.

Like soundguy said, unless you're trying to move the OU to a different domain, there's no reason to have to copy it.

Darrell Mozingo

 

[kkiedrowski]

ok.
ou 1 :no access to ie menus but can have acces control panel

ou 2 :access it menus but no control panel

if i have one group policy applied to both OU's how can i do this

 

[GrnEyedLdy]

KKiedrowski,

I understand what you want to do, I just don't think you can do this in 2000. If you copy a GPO to another OU using the ADD feature, any modifications you make to it at the new OU will effect the policy itself.

I beleive that Server 2003 has a cut -n- paste feature in the new Group Policy Management Console. Although this won't do you any good in 2000.


Patty

 

[kkiedrowski]

ok. I new about one change efeting everyone i just had no idea about cut and paste.
thanks

 

[Breakerfall]

what if you do this

•Create 2 groups:

1º Group
Name: NO_ACCESS_TO_IE_but_ACCESS_TO_CPANEL
Members: the users that should not have access to ie menus but can have acces control panel

2º Group
Name: ACCESS_TO_IE_but_NO_ACCESS_TO_CPANEL
Members: the users that need to access ie menus but no control panel

•Create 2 Domain GPO's

1º GPO
Name: NO_ACCESS_TO_IE_but_ACCESS_TO_CPANEL

2º GPO
Name: ACCESS_TO_IE_but_NO_ACCESS_TO_CPANEL


Right click your domain > properties > group policies
Move the GPO's to the top of the list.
Repeat the following steps on both GPO's:
Highlight the respective GPO, click properties
Go to security tab > Add and Remove the groups as needed.

-=-=-
then no matter where your users are in the domain (even if eventually you move them)
they will still get the GP applied ,unles you specifically say not to, and as long as they stay members of the groups.
-=-=-

kup
tnx.




Breakerfall
®º°¨¨°º can you ping me now...GOOD! º°¨¨°º®

 

[Breakerfall]

needless to say you can choose better names for the groups & gpo's





Breakerfall
®º°¨¨°º can you ping me now...GOOD! º°¨¨°º®

 

[GrnEyedLdy]

Why not create a GPO for each OU, link it to the appropriate OU and be done with it?


Patty

 

[Breakerfall]

GrnEyedLdy
'cause he's using only one OU,
and he needs to work with groups.

why, i don't know
but you post is valid.

cheers.


Breakerfall
®º°¨¨°º can you ping me now...GOOD! º°¨¨°º®

 

[kkiedrowski]

Icorected myself in one of my postings i mena OU's and never groups. Unfortunately I wasn;t able to transmit my thoughts so yo uwold know what I knew.
Have to break the habbit of using "groups" and OU interchangibly. [and have to spell better]
Thanks for the help

 

[GrnEyedLdy]

OIC

Thanks Breakerfall!