How To Prevent Domain Group Policies from Applying to Administrator Accounts and Selected Users in Windows Server 2003 (816100)

SUMMARY

This step-by-step article describes how to keep domain group policies from also applying to administrator accounts, selected users, or both. Windows Server 2003 uses group policies to control operating system behavior and security settings for users and computers in a Windows network, and group policies can be applied to either users or computers, or both, at the site, domain, or organizational unit level.

back to the top

Prevent Group Policies from Applying to Administrator Accounts

Typically, if you want Group Policy to apply only to specific accounts (either user accounts, computer accounts, or both), you can put the accounts in an organizational unit and then apply Group Policy at that organizational unit level. However, there may be situations where you want to apply Group Policy to a whole domain, but you may not want those policy settings to also apply to administrator accounts or other specific users or groups. The following procedure can prevent Group Policy from applying to administrative accounts (or any other group or user account you specify) by editing the Access Control List (ACL) for the policy:

1. Click Start, point to Administrative Tools, and then click Active Directory Users and Computers.
2. In the left console tree, right-click the name of the domain where the policy is applied, and then click Properties.
3. Click the Group Policy tab.
4. Click the group policy object that you do not want to apply to administrators. By default, the only policy that is listed in the window is the Default Domain Policy.
5. Click Properties, and then click the Security tab. If the group or user who you do not want policies to apply does not appear in the list, use the following procedure:
   1. Click Add.
   2. Click the domain where the account resides.
   3. Find the account, and then click it in the list.
   4. Click OK.
   Continue with the remaining steps.
6. Click the administrators group (or other group or user) that you do not want the policy to apply to.
7. In the Permissions windows, click to select the Deny check box for the Apply Group Policy permission. This prevents the group policy object from being accessed and applied to the selected group or user account.

back to the top