Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This is the first time I am setting up Active Directory on Server 2003 for my 5 Windows 7 clients. I am wondering if I set up group policy settings, will those override my account which is set up under the groups Administrators, Domain Admins, Domain Users, Enterprise Admins, Schema Admins.

I am not seeing any options to set up a group policy for just the "Domain Users" group, which will be the ones who I want to limit their access to certain things via group policy.

How do I set up group policies on a per-group basis, or is this something that will not affect me since I am a member of the Administrators group?

share|improve this question

migrated from Feb 5 '11 at 18:05

This question came from our site for computer enthusiasts and power users.

Having the word "Group" in the name "Group Policy" was a really, really unfortunate decision on Microsoft's part. – Evan Anderson Feb 6 '11 at 0:11
up vote 4 down vote accepted

Put your groups into separate OU's based on what you policies you want linked to them. Then in Group policy management, right click each OU and select link existing GPO. You will notice that at the top is the default domain policy if there is anyone you want exempt from this create an OU, right click it in GPO management and select block inheritance. Do not let your new GPO's you will be creating interfere with what is already on the default domain policy by default the default domain policy will override.

share|improve this answer
Perfect answer. Thanks so much. – muncherelli Feb 4 '11 at 16:45
@Mucherelli Glad I could Help out! :D – Not Kyle stop stalking me Feb 4 '11 at 16:48
there shouldnt be settings in the default domain policy which would make you want to block a hole OU's inheritance. Settings which only apply to paticular groups should be within their own policies. – edusysadmin Feb 13 '11 at 15:04

Group policies are applied to Organization Units and not groups, so setup a few OU's and apply policies as you wish. Read this for more details. I found this site to be a good resource for visual tutorials while using Windows Server.

And something easier to explain the process

Follow these:

1) How to create and organizational unit in Windows Server 2003

2) Working with Group Policy

share|improve this answer
+1 for links. Appreciate the help. – muncherelli Feb 4 '11 at 16:46
Group policies are most certainly applied to groups. Each policy has two components which include where it is linked and who it is security filterd too (on the scope tab of the policy in GMPC). A policy must be linked to a OU within the domain for it to apply, and the application of the policy is dependent on the filtering group specified, by default this is 'Authenticated Users' group. – edusysadmin Feb 13 '11 at 15:12

In your GPO > Delegation tab, uncheck the box for Apply Group Policy for Authenticated Users.

Add an Access Control Entry for the security group that you want the GPO to apply to. Ensure that the Read and Apply Group Policy boxes are checked for the group.

The GPO would need to be linked at the OU or higher where the security group is located.

Note that if you use this for a security group whose members are computers, and you add a computer to that group, the group membership will not take effect until the computer is restarted.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.