Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

As a local machine admin, is it possible to join a domain but still block group policy from being applied? I'm thinking it should be possible to remove all write access to the registry under, for example, HKCU\Software\Policies but in practice not sure how well this would work, or if there is already a better way to do so.

Let it be very clear: I am not interested in answers from the AD admin perspective, and even less interested in subjective answers of a self-righteous nature.

share|improve this question

closed as off topic by GregD, Chris S, EEAA, Zypher Nov 19 '10 at 21:12

Questions on Server Fault are expected to relate to server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

Guessing you're not an administrator of the domain and are trying to circumvent your appointed administrators security configuration. It's very simple for a domain admin to setup a machine on the domain and block group policy for it. So assuming you have a business case for that, just ask him/her. – Chris Thorpe Nov 19 '10 at 8:38
As sysadmins, we take security seriously. GPOs are an important way ot accomplishing this. I'm afraid you won't get much help in circumventing security policies here. – GregD Nov 19 '10 at 13:51
No I'm not the adminsitrator of a domain, but the business case has been ignored. The situation is that the company I work for has been bought out and over November our machines are being migrated onto the parent company's domain. This has already caused problems with overzealous things like for example forced folder redirection preventing explorer from launching, and when the case was put forth that we need machines excluded the only solution offered was to allow us to keep local admin rights on our machines... but that's really not a fix. – Nathan Chere Nov 22 '10 at 0:01

If you take permissions away from the SYSTEM account in HKLM, prepare for unexpected behavior if not outright failure. Filtering, as suggested, is the better way to go. There is also the possibility of making an OU for this machine that doesn't have any policies in it. A third option is to make a group full of computers that you want a certain policy to apply to. You then assign the policy to that group and any computers in the same OU that aren't a part of that group don't get the policy.

share|improve this answer

If you don't want certain policies applied to a machine then you should use the existing filtering options for GPOs. Trying to hack your way around the way the system works is not the correct way to achieve what you want.

share|improve this answer
This really doesn't answer the question, rather tries to shut it down. I'm specifically asking from a client machine perspective, not from domain admin. – Nathan Chere Jun 17 '15 at 13:10
@FerretallicA: We have a very strong culture of "Do it right or not at all". What you want to do is both doing it wrong and trying to circumvent policies imposed on you by the higher ups, which also isn't welcome here. Talk to the domain admins to apply filters to fix your issues (which can't be all that bad if they still exist after nearly 5 years). – Sven Jun 17 '15 at 14:02
Regardless, it's not an answer. It's a comment at best. – Nathan Chere Jun 17 '15 at 14:12

Not the answer you're looking for? Browse other questions tagged or ask your own question.