Prevent user policy on a particular computer

[meastaugh1]

Hi,

I have an AD in an education environment, so fairly restrictive computer and user GPs. I have one computer where I don't want this restriction at all. I've moved this computer outside of the OUs where GPOs are applying, so computer GPs are no longer applying. However, I have user policies which are applied to users (such as preventing them from viewing drive C) which is causing a problem on this particular machine, as they need to see it.

Is there a setting in the registry to prevent the machine from applying any policies at all, user or computer? Or any other suggestions welcomed.

Thanks

 

[dissolved]

So you are trying to ensure no policies get enforced to a particular set of users that are logging into a separate computer from a different OU?

I'd be interested in hearing the responses to this as well.

 

[secutanudu]

One way i could think of is to create a user policy on that machine with the rights that you want turned on, and enable loopback merge mode.

Loopback mode enables you to set a user portion of a group policy on a machine (not a user account). Once loopback mode is turned on, it will apply that user portion of the group policy to ANY user who logs onto that machine, and if you do it in merge mode, it will override any settings set previously by other policies (but leave all settings where they don't match alone). This should let you do what you want.


This setting is located in:
Computer Cofiguration-->
Administrative Templates-->
System-->
Group Policy-->
User Group Policy looback processing mode

 

[meastaugh1]

Sounds great, will give it a go.

Thanks

 

[secutanudu]

Let me know if you have any questions - i am new at this too but i will answer as best i can...

 

[secutanudu]

How'd it work?

 

[meastaugh1]

That worked great, thanks.

 

[meastaugh1]

Ok, I have a question, hopefully someone can help me with.

If I set user folder redirection on the computer OU with loopback policy processing applied. Should folder redirection then cease when the user logs on outside of that computer OU. That's not what seems to be happening. The user appears to be carrying the folder redirection with them.

Thanks