How do I apply user gp's depending on location?

[Toxie]

This may sound stupid, But stay with me.

I work in a college and we have a number of open access areas. I need to restrict the machine/user with GPO's in those areas only. However, I can only apply user settings for the User OU's I have created and not the Room OU's.

For example in room F4 they can use IE and the Run command but in Room B37 they can't. These restrictions are under the user configuration of the GPO.

Is there anyway of doing this? So basically I want the User GP to be machine dependant.

Regards

Toxie

 

[SteveAudus]

If you set up OU groups for rooms or locations, move your listed computers from computers into these OUs you should beable to apply Group Policies to the location OUs.

Please let me know if it works.

Steve Audus
Chaucer School
Sheffield

http://www.chaucer.sheffield.sch.uk

http://www.educationinternet.co.uk

 

[Toxie]

I've done that for the Computer Configuration part of the policy but it won't apply the user part as the users are not in that OU.

Thanks for trying though.

 

[fuunstatic]

this may be an option to explore

use a LOCAL group policy on the PC you want to place restrictions on (eg removing the run command)

Then ensure the "no override" option is selected (this will stop) higher level gps from overwriting it

 

[Toxie]

Cool, that works. But, how to distribute it to 2.5k machines. Shall I just copy the pol file from SystemRoot\System32\GroupPolicy\User to the other machines?

 

[fuunstatic]

not sure

the above example i explained is meant to be used for a few pcs etc in a public library, internet cafe etc

a better way may be like this

create an OU called students
create an OU called Staff or teachers

apply a GPo (user based) on students to restrict their desktop regardless of whatever pc they log onto
apply a different GPO (user based) on staff giving them more access

If you need a pc to have no restrictions then apply a local policy with no overide (loopback processing may also prove to be of help)

the design of the active directory is important from the start and does not have to necessarily map to the organisation heirachy