Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 7 down vote favorite

I have a GPO that I need to apply to the user DOMAIN\DumbGuy, but only when he logs on to DOMAIN\DumbGuysComputer$. When DOMAIN\NiceReceptionist logs on to DOMAIN\DumbGuysComputer$ it should not apply. When DOMAIN\DumbGuy logs on to DOMAIN\ReceptionstsComputer$ it should not apply.

It needs to only only apply to one person on one computer.

If I apply the GPO to the User object, it will apply to all his computers. If I apply the GPO to the Computer object, it will apply to all users on that computer. If I apply it to both, it spreads even wider.

How can I apply a GPO to just one user on just one computer?

share|improve this question
Are these just user settings? – pauska Nov 15 '12 at 7:17
Yes, it's a logon script – Mark Henderson♦ Nov 15 '12 at 7:37

4 Answers

up vote 8 down vote accepted

My suggestion is similar to inhabitant's..

Create a sub-OU just for that single computer, create a GPO in it and set it to loopback merge mode. Use security filtering on the GPO so that only DumbGuy have permissions to apply it. I don't see any reason for using two different GPO's.

Mucho importante! Don't filter the "read" rights from the authenticated users, as the group policy subsystem needs to read the GPO before it applies to the user

share|improve this answer
I've done this this morning and it worked well. Created a Sub-OU, put his computer in it, put the GPO on the OU and filtered it to his username. Perfecto. – Mark Henderson♦ Nov 15 '12 at 20:37
+1 - Exactly how I'd do it, too. – Evan Anderson Nov 15 '12 at 21:07
1  
P.S. Thanks for that last tip as well; I always forget that removing "Authenticated Users" from the security filtering removes their delegation permissions as well. – Mark Henderson♦ Nov 18 '12 at 21:14
up vote 4 down vote

I would look at Group Policy Loopback Processing in conjunction with Security Filtering. You can use the Group Policy loopback feature to apply Group Policy Objects (GPOs) that depend only on which computer the user logs on to.

This is an example of how it can be implemented.

Actually, how would I implement this:

Create two different GPO and assign them to DOMAIN\DumbGuysComputer$.

Configure first GPO with Loopback Processing set in Replace Mode and configure Security Filtering to apply only to DOMAIN\DumbGuy user.

Configure second GPO without Loopback Processing and configure Security Filtering to apply only to DOMAIN\NiceReceptionist users.

share|improve this answer
up vote 3 down vote

I would probably just link the GPO to the OU that the user is in and use security filtering or WMI to make sure that it only applies to that one user, then wrap the whole script in a if($ENV:computername -eq whatever){} block.

share|improve this answer
This is very clever! Pauska's solution was a bit neater, but if I ever can't move the computer's OU I will do this. – Mark Henderson♦ Nov 15 '12 at 20:37
up vote 0 down vote

GPO apply to ether the user object, computer object or both objects in a OU and you can't make the GPO apply only to a computer object only if a certain user logs in to that computer or apply to a user object only if that user logs into a certain computer.

share|improve this answer
It would appear you can't do this with standard filtering, but there are workarounds for it – Mark Henderson♦ Nov 15 '12 at 20:36

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.