I got 5 servers where i need to lock them down so as standard there is only read only access to the C drive and a couple of other servers where full admin access is required all the time. There is a need however that out of the 5 servers that are locked down all the time a user can request access and they be moved into an approved security group for that server.
I have created an OU group for each server and inside that OU there is an approved and denied policy along with a approved security group and a denied security group. I have taken off the authenticated users off each policy and applied only the security group that relates to the policy and the server.
The problem i am facing is this,
If i assign a user to the denied group for server 1 and the approved security group for server 2 - the approved rights for server 2 are also applied to server 1. It does not matter how many restricted groups a user is in, if i apply even 1 of of approved group it applies to all servers.
I have set each policy to enforced and linked and have listed them in the following order.
Hopefully this is something simple so sorry if its a silly thing - sadly it has been a while sense i have done anything with group policy.