How to exclude a specific user from group policy object (GPO)

this video I'm going to show you how to use Group Policy security filtering to limit which users and computers if Group Policy is applied to so for example I've got this limited control panel items Group Policy applied to HR OU so this group policy will be applied to all of these users in this OU so if I put go to a computer I'm logged in as one of those HR users they're getting this group policy that is limiting which control panel items they have access to but I want to make some exclusions or certain users like our admin users and specific users in that hro that need access to all our control panel items so an easier way to do that is with the security filtering so instead of creating another OU moving users around doing odd things like that it's much easier I think and cleaner to use this security filtering so what you want to do is first create a group and I'm going to call mine GPO deny limit control panel items you can name yours whatever you want but I like to name it something descriptive and then all you do is add in the users that you want to deny that group policy so the this this user will have full access to the control panel items because they're going to be denied that policy that is restricting the control panel items so once you create your group come into group policy and then come on to the delegation tab click advanced click add now add that group that you just created and then what you're going to do is come down to apply group policy and you're going to select deny it's very important that you leave read alone you want the group policy to be left as read you just want it to deny applying the group policy to that group everything else stays the same so now when I log in with that user that's in this group Allen keys that user should have full access to control panel so as you can see I didn't have to rearrange any ous didn't have to move users around all I did was create a group and modified the security filtering on the GPO so let me jump over to this computer I'm going to log in with that user and that user should have full access to the control panel okay I'm logged in let me pull up the control panel and there you can see that that user has full access to the control panel and we can verify What's Happening by running the GPU result command this will show you all of the group policies that is applied to the user keep your result slash r and you can see here's the apply Group Policy object there's three and then the following gpos were not applied because they were filtered out and there you can see the limit control panels items policy was was denied um and let me log in with the other user and you'll see that you'll see that this is not filtered out okay I'm logged back in with the user that uh policy is applied to if I run GP results you can see that the applied Group Policy objects limited control panel items and come down here to the following gpos or not applied because they were filtered out and that that limited control panel items is not listed there so that's it again just a really I find it a simple way to limit which users or computers have access to a Group Policy treat it like as an exclusion list so it's really useful when you have ous that are applied at a higher up level like at the Domain level or at a root level so like the BitLocker here or this Chrome settings so because this Group Policy is apply to the domain level is going to be applied to every user in the domain so with a with a group policy applied at that high level you probably will have the need for some exclusions and that's where you could use this security filtering to apply some exclusions so that's it for this video thanks for watching

Channel: Active Directory Pro

Views: 33,718

Keywords: active directory, sysadmin, windows server

Id: f_7Tz-UnofQ

Length: 5min 34sec (334 seconds)

Published: Wed Mar 01 2023