RE: [ActiveDir] GPO troubles

[Darren Mar-Elia]

If you truly want to control a user policy based on the computer, then loopback is the right choice. You don't have to create a separate OU to do that. It makes it more obvious when you have machines controlled by loopback in a separate OU, but you can use security permissions to control it, as you've suggested. So, the way this might work is that you create a new GPO, enable loopback policy, setting loopback mode to replace, leave the ScreenSaver settings at Not Configured and then permission the GPO by removing the Authenticated Users ACE and adding Read and Apply Group Policy perms to your excluded computer group. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rimmerman, Russ Sent: Friday, May 14, 2004 1:38 PM To: '[EMAIL PROTECTED]' Subject: RE: [ActiveDir] GPO troubles Sensitivity: Private I just thought you could avoid creating an OU mess by using the security permissions (apply gpo, deny gpo) on each GPO properties. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Creamer, Mark Sent: Friday, May 14, 2004 3:20 PM To: [EMAIL PROTECTED] Subject: RE: [ActiveDir] GPO troubles Sensitivity: Private I don't think so - screen savers are configured on the user, and you want to limit by the machine. That's why the Loopback policy, and the reason for segregating the machines in a separate OU. Others please chime in if I'm wrong though...   <mc> -----Original Message----- From: Rimmerman, Russ [mailto:[EMAIL PROTECTED] Sent: Friday, May 14, 2004 4:14 PM To: '[EMAIL PROTECTED]' Subject: RE: [ActiveDir] GPO troubles Sensitivity: Private   Is it absolutely necessary to create a whole seperate GPO for these computers?  Seems like it will create an administrative nightmare.  Can't you just deny access to the default domain GPO and it won't apply the screen saver settings?   From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Creamer, Mark Sent: Friday, May 14, 2004 3:04 PM To: [EMAIL PROTECTED] Subject: RE: [ActiveDir] GPO troubles Sensitivity: Private Russ, I believe what you need to do is set up an OU and put those machines in it. Then set the group policy Computer Configuration setting User Group Policy Loopback processing mode. Set the Screen Saver policy accordingly in the User Configuration section.   Then users who log in to those machines should no longer be subject to the policy that enforces the screen saver   <mc> -----Original Message----- From: Rimmerman, Russ [mailto:[EMAIL PROTECTED] Sent: Friday, May 14, 2004 3:57 PM To: '[EMAIL PROTECTED]' Subject: [ActiveDir] GPO troubles Sensitivity: Private   We have password protected screensavers enabled in our default domain policy, and then at a lower OU level, I have a GPO linked that is set to Screen Savers "Not configured".  Basically, we want all users to have password protected screensavers except a select few machines.   So, I created a security group called "No Screensaver" and added computer accounts that we don't want screensavers to be enforced on.  Then I went into our default domain policy, and added deny read and deny apply gpo to this No Screensaver group.  The GPO that IS applied only to the No Screensaver group has all the screen saver settings set to "Not configured" and the Password Protect the Screensaver GPO is "Disabled".    Once a GPO is applied to a PC, do you have to "Disable" it to unapply it, or will setting it to "Not configured" put it back to normal?    I added my computer to this No Screensaver group, and still my screen saver settings and buttons are greyed out and it will not let me change it.   Thanks ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This e-mail is confidential, may contain proprietary information of the Cooper Cameron Corporation and its operating Divisions and may be confidential or privileged. This e-mail should be read, copied, disseminated and/or used only by the addressee. If you have received this message in error please delete it, together with any attachments, from your system. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This e-mail is confidential, may contain proprietary information of the Cooper Cameron Corporation and its operating Divisions and may be confidential or privileged. This e-mail should be read, copied, disseminated and/or used only by the addressee. If you have received this message in error please delete it, together with any attachments, from your system. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This e-mail is confidential, may contain proprietary information of the Cooper Cameron Corporation and its operating Divisions and may be confidential or privileged. This e-mail should be read, copied, disseminated and/or used only by the addressee. If you have received this message in error please delete it, together with any attachments, from your system. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~