As a local machine admin, is it possible to join a domain but still block group policy from being applied? I'm thinking it should be possible to remove all write access to the registry under, for example, HKCU\Software\Policies but in practice not sure how well this would work, or if there is already a better way to do so.
Tell me more
×
Server Fault is a question and answer site for
professional system and network administrators. It's 100% free, no registration required.
|
closed as off topic by GregD, Chris S♦, EEAA, Zypher♦ Nov 19 '10 at 21:12
Questions on Server Fault are expected to relate to professional server, networking, or related infrastructure administration within the scope defined in the FAQ. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about closed questions here.
|
If you take permissions away from the SYSTEM account in HKLM, prepare for unexpected behavior if not outright failure. Filtering, as suggested, is the better way to go. There is also the possibility of making an OU for this machine that doesn't have any policies in it. A third option is to make a group full of computers that you want a certain policy to apply to. You then assign the policy to that group and any computers in the same OU that aren't a part of that group don't get the policy. |
|||
|
|
|
If you don't want certain policies applied to a machine then you should use the existing filtering options for GPOs. Trying to hack your way around the way the system works is not the correct way to achieve what you want. |
|||
|
|
