The Stack Overflow podcast is back! Listen to an interview with our new CEO.
2 deleted 175 characters in body
source | link

Use an OU - there is no such thing as a network too small to use an OU. Apply the policies to the OU as you can't apply Group Policies to the default users and computers container.

Policies apply in order listed, if your management policy is at the top, any settings the normal user policy that conflict would overwrite settings the management policy.

If you want to use this setup, I would create a "Computer" OU, move all the regular computer accounts to that OU and apply the default comptuer OU there. Create a child OU "MgmtComputers" OU off the Computer OU and apply just the MangementManagement computer OU there.

Edit: BTW - if you are setting "domain users" as local administrators in your default computer policy and allowing "Log On Locally" to include the administrator group, since every domain user is a local admin, it would still allow every user to login to every computer.

Use an OU - there is no such thing as a network too small to use an OU. Apply the policies to the OU as you can't apply Group Policies to the default users and computers container.

Policies apply in order listed, if your management policy is at the top, any settings the normal user policy that conflict would overwrite settings the management policy.

If you want to use this setup, I would create a "Computer" OU, move all the regular computer accounts to that OU and apply the default comptuer OU there. Create a child OU "MgmtComputers" OU off the Computer OU and apply just the Mangement computer OU there.

Use an OU - there is no such thing as a network too small to use an OU. Apply the policies to the OU as you can't apply Group Policies to the default users and computers container.

If you want to use this setup, I would create a "Computer" OU, move all the regular computer accounts to that OU and apply the default comptuer OU there. Create a child OU "MgmtComputers" OU off the Computer OU and apply just the Management computer OU there.

Edit: BTW - if you are setting "domain users" as local administrators in your default computer policy and allowing "Log On Locally" to include the administrator group, since every domain user is a local admin, it would still allow every user to login to every computer.

1
source | link

Use an OU - there is no such thing as a network too small to use an OU. Apply the policies to the OU as you can't apply Group Policies to the default users and computers container.

Policies apply in order listed, if your management policy is at the top, any settings the normal user policy that conflict would overwrite settings the management policy.

If you want to use this setup, I would create a "Computer" OU, move all the regular computer accounts to that OU and apply the default comptuer OU there. Create a child OU "MgmtComputers" OU off the Computer OU and apply just the Mangement computer OU there.