Server 2003 Group Policy for different groups

Question

This is the first time I am setting up Active Directory on Server 2003 for my 5 Windows 7 clients. I am wondering if I set up group policy settings, will those override my account which is set up under the groups Administrators, Domain Admins, Domain Users, Enterprise Admins, Schema Admins.

I am not seeing any options to set up a group policy for just the "Domain Users" group, which will be the ones who I want to limit their access to certain things via group policy.

How do I set up group policies on a per-group basis, or is this something that will not affect me since I am a member of the Administrators group?

Answer 1

Put your groups into separate OU's based on what you policies you want linked to them. Then in Group policy management, right click each OU and select link existing GPO. You will notice that at the top is the default domain policy if there is anyone you want exempt from this create an OU, right click it in GPO management and select block inheritance. Do not let your new GPO's you will be creating interfere with what is already on the default domain policy by default the default domain policy will override.

Answer 2

Group policies are applied to Organization Units and not groups, so setup a few OU's and apply policies as you wish. Read this for more details. I found this site to be a good resource for visual tutorials while using Windows Server.

And something easier to explain the process

Follow these:

1) How to create and organizational unit in Windows Server 2003

2) Working with Group Policy

Answer 3

In your GPO > Delegation tab, uncheck the box for Apply Group Policy for Authenticated Users.

Add an Access Control Entry for the security group that you want the GPO to apply to. Ensure that the Read and Apply Group Policy boxes are checked for the group.

The GPO would need to be linked at the OU or higher where the security group is located.

Note that if you use this for a security group whose members are computers, and you add a computer to that group, the group membership will not take effect until the computer is restarted.