Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

As a local machine admin, is it possible to join a domain but still block group policy from being applied? I'm thinking it should be possible to remove all write access to the registry under, for example, HKCU\Software\Policies but in practice not sure how well this would work, or if there is already a better way to do so.

share|improve this question

closed as off topic by GregD, Chris S, EEAA, Zypher Nov 19 '10 at 21:12

Questions on Server Fault are expected to relate to server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here. If this question can be reworded to fit the rules in the help center, please edit the question.

Guessing you're not an administrator of the domain and are trying to circumvent your appointed administrators security configuration. It's very simple for a domain admin to setup a machine on the domain and block group policy for it. So assuming you have a business case for that, just ask him/her. –  Chris Thorpe Nov 19 '10 at 8:38
As sysadmins, we take security seriously. GPOs are an important way ot accomplishing this. I'm afraid you won't get much help in circumventing security policies here. –  GregD Nov 19 '10 at 13:51
No I'm not the adminsitrator of a domain, but the business case has been ignored. The situation is that the company I work for has been bought out and over November our machines are being migrated onto the parent company's domain. This has already caused problems with overzealous things like for example forced folder redirection preventing explorer from launching, and when the case was put forth that we need machines excluded the only solution offered was to allow us to keep local admin rights on our machines... but that's really not a fix. –  FerretallicA Nov 22 '10 at 0:01

2 Answers 2

If you don't want certain policies applied to a machine then you should use the existing filtering options for GPOs. Trying to hack your way around the way the system works is not the correct way to achieve what you want.

share|improve this answer

If you take permissions away from the SYSTEM account in HKLM, prepare for unexpected behavior if not outright failure. Filtering, as suggested, is the better way to go. There is also the possibility of making an OU for this machine that doesn't have any policies in it. A third option is to make a group full of computers that you want a certain policy to apply to. You then assign the policy to that group and any computers in the same OU that aren't a part of that group don't get the policy.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.