Policy enforced to an account ?

[Chaingang]

I have server 2003 and Win XP pro work stations. I've created a policy that I want to enforce on a user that will change the work station for that individual. I created a work station policy but want different user's to have different rights. When I attach the server policy it does'nt restrict the work station as it should. I must be missing something ?

[MadMedic]

Do you have the policy applied to specific workstations or to a user group or individual users?

[Chaingang]

I created a group policy, So I guess my question is how can I enforce it to a user that will follow him to any workstation he will log in to.

[MadMedic]

Either assign him to a current user group and apply the policy to that group or create a new group and assign the policy to that group and then assign whatever users you want to that group. I am assuming you know how to assign a global policy to affect a user group. If not let me know and I will tell you.

[Chaingang]

Apparently I dont, If you could Explain I would appreciate it. I just was'nt sure if I attach the group to the properties on the user or attach the users from the groups policy properties.

[MadMedic]

You can do it through the MMC. You need to have the Group Policy Management Snap In Installed. The navigate your way to the policy.... Forest ---> Domains ---> Then you should see your domain ---> Then go to the policy that you want to assign the group to. You'll want to be under the scope tab. Under Security Filtering section click on the add button and then select the group that you want to apply the policy to. Remember the users who you want this to apply to need to be assigned to a security group.

If you changed anything under the properties of the policy then you are only change who can access the policy and what they can do to it.


You can apply this to a single individual, but I am assuming that you want to apply it to a group of users. To do it to a single person you just select the individual from the list rather than a group.

[MadMedic]

Chaingang did you have any luck with that? Just wanted to see how things turned out for you.

[Chaingang]

yes it worked when I tested it. I want to get the bugs out before I totally switch over. Currently using Novell 5 so im hoping this will be alot better.

Thanks alot for your help

[MadMedic]

Glad I was able to help someone.

[paulmun75]

If you have small network, consider installing Group Policy Management Console (GPMC) SP1. It is more powerfull than the default GPM snap-in you'll find within the Server distribution. After that, you will need to put the needed group into a security filter. If you plan to manage a huge network (I guess huge is one that starts from several dozens or hundred machines) consider using third-party products aimed at performing such specific tasks. I use Scriptlogic's Desktop Authority. It greatly supplements the built-in group policy management abilities. I can create policies based on a richer set of rules. Previosly I was locked by bounds of four objects (site, unit, group, user). Now I am able to choose from several dozen of conditions. It is really helpful when I can apply policies, not only when user logs on, but based on the predefined refresh time.

[MadMedic]

You can actually specify the refresh rate intervals to as often as 1 minutes. I have it refreshed every 10 minutes so that if I make a change I don't have to worry about having users log off and back on. Not that I make changes that often.