GPO - computer versus user settings

[cwissy]

Can anyone explain which I should be using? Or a book on the subject? There are so many settings and so many levels I am at a loss to know which to use! We want to apply polices to users but the policy needs to address computer settings such as background, prevent changes to all sorts of things and lock the desktop, hide C: drive etc. etc.
Has anyone produced a book on this?

 

[mrdenny]

I'm not sure if anyone has a book on this.

You put the GPO in the user settings when you want the settings to effect that user no matter what machine they log into.

You put the GPO in the computer settings when you want the settings to effect every user that sits at that machine.

Does that help?

Denny

--Anything is possible. All it takes is a little research. (Me)

http://www.mrdenny.com

(My very old site)

 

[cwissy]

Yes thanks that helps, I am totally new to this and trying to set up a server 2003 netword, always been Novell so finding it hard to 'forget' the way we did things in Novell and getting my head around MS server 2003

Thanks

 

[cwissy]

If you apply to computer, wouldn't you use the GPO on the group of computers that you want to apply it to? This policy I am setting up now is for an OU for year 12 students, in other words users. Do computer based policies work when applying to an OU of users?

 

[anthonymel]

Hmm thats a good question. But I'll tell you how I did it at my school. OUs can contain anything, any object, such as computers or users or printer etc... I broke down the school into OUs base on operating systems. One OU for XP machines and one OU for 2000 machines. Then I broke it down to locations. So under the XP OU I created another OU called RM105. Its a desktop publishing class so the kids get a litte more freedom. So their user settings are not that restrictive while the computer settings are nonexsistant except for software installation which will install graphics apps everytime a new machine joins the domain. It get pretty complicated at some point but check out this site.

http://www.computerperformance.co.uk

look under Windows 2003 for further help

And this book: Active Directory by O'Reilly

 

[cwissy]

Thanks I will do, I am going to try and enrol in a admin type course soon so hopefully I will learn all this stuff

 

[NickFerrar]

http://www.gpoguy.com

is a good site although deals more with advanced topics.

A good primer I read is the free ebook available at

http://www.realtimepublishers.com,

exact link to the book is:

http://cc.realtimepublishers.com/publicationhome.asp?pid=25

You need to register and get sent the odd email but well worth it.

 

[bofhrevenge2]

Hi cwissy,

Do computer based policies work when applying to an OU of users?

Computer settings need to be set at the OU containing the computers, then as mrdenny says they effect every user that sits at that machine. If you set them on a users OU they will have no effect as the PC's will not process the policies at start up.

 

[cwissy]

Our computers folder is directly under the domain, the OU's are set to divide year levels and campus's, can I 'move' the computers folder to under the campus OU? I am a bit scared to try as we are so short of time and I don't want to destroy anything.

 

[meastaugh1]

Do computer based policies work when applying to an OU of users?"

No, but you might want to look at loopback policy processing. This was pointed out to me on tek-tips a few weeks ago, and have found useful (particularly in a school environment). Basically it allows you to apply user policies on an OU containing computers. When a user logs on to a computer within this OU, you have the option to merge or replace user policy settings inherited from the OU that the user is in.

I realise that the above probably makes little sense, so have a look here:

http://support.microsoft.com/kb/231287/EN-US/

 

[cwissy]

Thanks all, I think I have enough reading to last me a while now, I do appreciate all your help

Chris

 

[aftertaf]

cwissy...
a bit of advice on OUs...
try not to use too many of them... they are primarily a unit of administration...
If you have too complicated an ou structure, you get caught up in your own organisational trap.

I'm preparing MCPs on Active Directory at the moment, and the books all say don't create OU structure just for the sake of it, but with three reasons in mind:
-delegation of administration,
-hiding objects,
-cant remember.... er...oh yeah... Group policy (had a quick look at my notes...)

key word, be it domain, ou, gpo, site design is: keep it simple, as simple as possible!!

and don't forget, between the FAQs, tektips forums and google, there is all the info you need out there... it's knowing what to look for...


Aftertaf (david)

 

[bofhrevenge2]

meastaugh1 is right loopback processing is very handy, just beware it still will not allow computer based policies to work when applying to an OU of users. It will however allow User Configuration to effect users when the policy is applied to an OU of computers.