"Allen" <ats42@newsgroup> wrote in message
> On Wed, 21 Oct 2009 13:38:38 +0000 (UTC), Meinolf Weber [MVP-DS] wrote:
>> Hello Allen,
>> You have to use an additional OU in AD UC and move the users there, now
>> can create and link a new GPO here. Also do not apply GPOs on domain
>> always built your own OU structure, so you can separate all needs.
>> Best regards
>> Meinolf Weber
>> Disclaimer: This posting is provided "AS IS" with no warranties, and
>> no rights.
>> ** Please do NOT email, only reply to Newsgroups
>> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>>> I have a group policy that applies to all users on the domain. I want
>>> to create another group policy with less restrictions for a specific
>>> set of users. How do I go about doing this?
> Thanks for this. So if I create a new OU in ADC, move specific users to
> here, do I just create a brand new policy for them? Or can I use teh
> current policy and create a 2nd one as well? Is there a heirarchy of
> policies within an OU?
Did you create a separate GPO at the domain level, or did you alter the
Default Domain Policy GPO? Assuming you did not alter the Default Domain
Policy (which is recommended not to touch it), as Meinolf stated, you simply
create an OU, move your users into and unlink the additional policy you
created at the domain level, but now link it to the new OU you created. If
you have different settings for different users, create additional OUs with
their own new GPOs with the different settings.
If you had altered the default Domain Policy, I would suggest to remove the
changes made in that policy (since it should be left alone), and create the
GPOs you need for the OUs you would create for the users that need different
There is no 'hierarchy' of GPOs, rather just a list of GPOs. The hierarchy
is the OU structure, which you design and create for both organizing your
objects (computers, users, groups and other objects), as well as for GPO
applying and flow.
Take a look at the following, which may help:
Intro to GPOs http://www.fekay.com/supportblogs/IntroToGPOs.HTML
GPO Inheritance http://www.fekay.com/supportblogs/gpoflow.jpg
This posting is provided "AS-IS" with no warranties or guarantees and
confers no rights.
Please reply back to the newsgroup or forum for collaboration benefit among
responding engineers, and to help others benefit from your resolution.
Ace Fekay, MCT, MCITP EA, MCTS Windows 2008 & Exchange 2007, MCSE & MCSA
2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer
For urgent issues, please contact Microsoft PSS directly. Please check http://support.microsoft.com
for regional support phone numbers.