Group Policy for users

[acn]

I'm currently running a windows 2000 network with a 2000 server and 2000 professional workstations.

I've set-up active directory and can logon to the domain perfectly from the workstations. Whenever i logon it applies the Default Domain Policy for all users.

I was wondering if there was any way to change the whole group policy for different user groups. For example: I would like to disable features such as Lock Workstation and other stuff for normal users but keep it enabled for Administrators.

I'm sure there must be a away as it was possible with the System Policy Editor but I can't get this to work on my 2000 server system.

Any ideas?

Thamks in advance.

 

[groovyfill]

normaly the group policy doesn't have effect on the administrators


or you can make organizational units in the AD


greetz

groovy

 

[acn]

how do you make organizational units?

 

[ksukenny]

in active directory users and computers right click the domain and select new organizational unit. move the users you want to apply the policy to into that OU and apply the GPO to that OU

 

[acn]

thanks - some how I already knew that - dunno why I asked really - sorry.

 

[ronnetp]

I am having the same problem, I created the OU applied the GPO to the OU, but when the clients logs on, the desktop does not show the policy.

Any idea why?

 

[Claudek]

Did you apply in the security for the Group policy the members of that particular OU. For eg, all the users in that OU belong to a global group called ABC. When you apply the group policy to the OU, in the security option you add the global group ABC and check the box which says Apply Group Policy (or something similer) to them.
You can then run the commands below on a dos prompt on your domain controller to get the changes done straight away.
SECEDIT /REFRESHPOLICY MACHINE_POLICY /ENFORCE
SECEDIT /REFRESHPOLICY USER_POLICY /ENFORCE




Claudius (What certifications??)

http://www.iteq.com.au

 

[BWilson77080]

go into the properties of the GPO, go to the security tab, add teh domain admins or applicable administrators group and click the deny read and apply group policy permissions.

 

[BWilson77080]

keep authenticated users in there though so it still applies to everyone else

the deny permissions for administrators will voerride the authenticated users permissions

none of the group policy will apply to the admins anymore though

 

[BWilson77080]

default permissions for a group policy by the way are read and apply group policy to the authenticated users group...all authenticaetd users