Susan, You can restrict GPOs to certain groups by using either Deny or Allow permissions. So in your case you could deny a particular security group access to the GPO. If you leverage the GPMC you can use the delegation tab to explicitly deny a groups access to the GPO.
As for diagramming, I depends on what you want to get out of the diagram. Visio is OK for some things while the GPMC can provide nice reports for others. Aric -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP] Sent: Wednesday, September 21, 2005 2:58 PM To: [email protected] Subject: [ActiveDir] Group policy stupid question Stupid question that showcases how I don't know enough about GP Is there a way to do a group policy group so that it's "Everyone" but <-> "this group" And does Visio work the best for diagramming these structures out? <SBSlurker> -- Letting your vendors set your risk analysis these days? http://www.threatcode.com List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
