Group Policy Help!!

OK here is the problem. I have a widnows 2003 server that
will be installed into a school....all machines will logon
to that domain. All machines must have certain
restrictions e.g desktop settings, adding and removeing
programs\ control panel restrictions e.t.c. I have been
looking at using the GP to force these settings down to
the workstations. Young pupils will be using the machines
and so there will be a lot of enforcments through GP.

1.I want teachers to be able to have full access to there
machine that is a part of the same domain without any of
the GP restrictions?

2.How can somone have full access to the pupils machines
without disabling the GP option. Can certain users\groups
(in Active Directory) be omitted from the GP?

[Eric Weintraub]

On 6/18/04 9:06 AM, in article 1df0c01c45535$04386950$a601280a@phx.gbl,
"anonymous@discussions.microsoft.com" <anonymous@discussions.microsoft.com>
wrote:

> OK here is the problem. I have a widnows 2003 server that
> will be installed into a school....all machines will logon
> to that domain. All machines must have certain
> restrictions e.g desktop settings, adding and removeing
> programs\ control panel restrictions e.t.c. I have been
> looking at using the GP to force these settings down to
> the workstations. Young pupils will be using the machines
> and so there will be a lot of enforcments through GP.
>
> 1.I want teachers to be able to have full access to there
> machine that is a part of the same domain without any of
> the GP restrictions?
>
> 2.How can somone have full access to the pupils machines
> without disabling the GP option. Can certain users\groups
> (in Active Directory) be omitted from the GP?

Put the teachers in a OU and create a GPO for that OU

Put the Kids in a OU and create a different OU

-DOMAIN(DC) GPO Master
-(OU) Teachers - GPO 1
-(OU) Kids GPO - 2

Also make all the lock down changes in the Users section of the GPO not the
Computer section.

Cheers

J5 - Eric A. Weintraub
Sr. Network Administrator
ScriptLogic Corp
--

Cheers. So if I have a GP for OU1 and OU2 then will these
overide the main domain GP? and will users applying the
domain GP and not the OU GP work ok?

>-----Original Message-----
>On 6/18/04 9:06 AM, in article 1df0c01c45535$04386950

$a601280a@phx.gbl,

>"anonymous@discussions.microsoft.com"

<anonymous@discussions.microsoft.com>

>wrote:
>

>> OK here is the problem. I have a widnows 2003 server

that

>> will be installed into a school....all machines will

logon

>> to that domain. All machines must have certain
>> restrictions e.g desktop settings, adding and removeing
>> programs\ control panel restrictions e.t.c. I have been
>> looking at using the GP to force these settings down to
>> the workstations. Young pupils will be using the

machines

>> and so there will be a lot of enforcments through GP.
>>
>> 1.I want teachers to be able to have full access to

there

>> machine that is a part of the same domain without any of
>> the GP restrictions?
>>
>> 2.How can somone have full access to the pupils machines
>> without disabling the GP option. Can certain

users\groups

>> (in Active Directory) be omitted from the GP?

>
>Put the teachers in a OU and create a GPO for that OU
>
>Put the Kids in a OU and create a different OU
>
>-DOMAIN(DC) GPO Master
> -(OU) Teachers - GPO 1
> -(OU) Kids GPO - 2
>
>Also make all the lock down changes in the Users section

of the GPO not the

>Computer section.
>
>Cheers
>
>J5 - Eric A. Weintraub
>Sr. Network Administrator
>ScriptLogic Corp
>--
>
>
>.
>

[Eric Weintraub]

On 6/18/04 10:21 AM, in article 1dfad01c4553f$988a2f30$a601280a@phx.gbl,
"anonymous@discussions.microsoft.com" <anonymous@discussions.microsoft.com>
wrote:

> Cheers. So if I have a GP for OU1 and OU2 then will these
> overide the main domain GP? and will users applying the
> domain GP and not the OU GP work ok?
>

>> -----Original Message-----
>> On 6/18/04 9:06 AM, in article 1df0c01c45535$04386950

> $a601280a@phx.gbl,

>> "anonymous@discussions.microsoft.com"

> <anonymous@discussions.microsoft.com>

>> wrote:
>>

>>> OK here is the problem. I have a widnows 2003 server

> that

>>> will be installed into a school....all machines will

> logon

>>> to that domain. All machines must have certain
>>> restrictions e.g desktop settings, adding and removeing
>>> programs\ control panel restrictions e.t.c. I have been
>>> looking at using the GP to force these settings down to
>>> the workstations. Young pupils will be using the

> machines

>>> and so there will be a lot of enforcments through GP.
>>>
>>> 1.I want teachers to be able to have full access to

> there

>>> machine that is a part of the same domain without any of
>>> the GP restrictions?
>>>
>>> 2.How can somone have full access to the pupils machines
>>> without disabling the GP option. Can certain

> users\groups

>>> (in Active Directory) be omitted from the GP?

>>
>> Put the teachers in a OU and create a GPO for that OU
>>
>> Put the Kids in a OU and create a different OU
>>
>> -DOMAIN(DC) GPO Master
>> -(OU) Teachers - GPO 1
>> -(OU) Kids GPO - 2
>>
>> Also make all the lock down changes in the Users section

> of the GPO not the

>> Computer section.
>>
>> Cheers
>>
>> J5 - Eric A. Weintraub
>> Sr. Network Administrator
>> ScriptLogic Corp
>> --
>>
>>
>> .
>>

Yes the OU GPO's would override except for some of the security stuff in the
computer section. It would also use any of the master domain GPO that did
not conflict.

Cheers

J5 - Eric A. Weintraub
Sr. Network Administrator
ScriptLogic Corp
--