Modifying the GPO Security Filtering of Using GPMC
Modifying the GPO Security Filtering of Using GPMC
1. Start the GPMC (Group Policy Management Console) on Windows Server 2008 by clicking Start, then Administrative Tools, and then Group Policy Management.
2. If you have not already added your Active Directory Forest to the GPMC, do so by right-clicking the root Group Policy Management node and typing in the DNS name of your forest root domain.
3. Now expand the forest node to manage the domain of interest. If the domain you want to manage is not the forest root domain, right-click the Domains node and select Show Domains to choose additional domains.
4. Within each domain node is a Group Policy Objects node. Expand this node and highlight the GPO (Group Policy Objects) whose security filter you want to modify.
5. With the target GPO highlighted, ensure that the Scope tab in the right-hand result pane is selected. The Security Filtering section will appear within this pane.
6. First, remove Authenticated Users from the security filtering list, while this permission is in place, all users and computers will process this GPO. Highlight the Authenticated Users entry and click Remove.
7. Click Add button and enter the name of a user or computer group that you want to use for security filtering. Note that computer groups are used to filter computer-specific policy (that policy which exists within the Computer Configuration section of a GPO) and user groups are used to filter user-specific policy (that policy which exists within the User Configuration section of a GPO). Click Check Names to resolve the group name and then click OK to confirm your choice. The new group is added to the Security Filtering section of the GPO Scope tab.
The GPMC is really adding the Read and Apply Group Policy permissions for the group you added to this GPO. Note that you could also add an individual computer or user account to a security filter. While this is not a best practice, it may be useful for testing purposes to have a GPO only apply to a single computer or user.
|
Linear Mode
