Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've created a GPO in SBS 2008 that deploys and updates software. Unfortunately, one of our VPN users lives out in the sticks and has severe latency, so the start up processes and updates time out and take an awfully long time, if they ever complete at all.

I'd like to apply this GPO to all auth'd users except for him, without having to create a new custom user group. Any thoughts?

share|improve this question
up vote 6 down vote accepted

You could name the user in the "Security" on the GPO with "Apply Group Policy / Deny" permission. It's not really good form to name an individual user in permissions, ever, but you could do that. Edit the GPO, right-click the top-most node in the left pane of the GPO editor, choose "Properties" and go to the "Security" tab.

(I won't get preachy in this email, but I will say that you shouldn't be adverse to creating security groups, even if they're just for a single user. Security groups will save you lots and lots of time when turnover occurs and you have to give the replacement employee the "same rights" as the person they're replacing...)

share|improve this answer
+1 Agree about creating groups for even single user. Makes things a lot easier now and especially in the future when someone needs to figure things out. Possibly without any documentation. – Dave M Mar 25 '10 at 19:21

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.