1

I recently took over a network and I'm still pretty raw in regards to AD and group policy. I've been trying to use group policy to restrict CD burning rights to only 3 users and only their 3 computers. If this is impossible I would settle for restricting all but those 3 users from burning cds. I've been tinkering with the "CD/DVD: Deny write access" policy for awhile, but I keep running into the same problem. I either open up it up for all users and computers, or shut it down for all users and computers. Is it possible to set this policy up so that I have cd burning rights on a computer when i log in, and the next guy does not when he logs in?

2 Answers 2

1

Ravasquezgt's answer works, but you'll find it falls apart when you need multiple groups of users for different policies. You could do this a LOT more easily with security filtering. Simply create a group in AD for the users you want restricted, add those users to that group, and then add that group to the security filtering list on the policy object (remove the default "authenticated users" group first). While a user can only be in one OU at a time, they can be in an unlimited number of groups, making this a much more flexible solution.

enter image description here

2
  • Tested and confirmed working, I should have asked this question earlier, could have saved myself alot of frustration. Thank you so much!
    – Jeff S.
    Sep 29, 2014 at 19:04
  • No problem, glad it worked for you! Sep 30, 2014 at 3:54
0

You can restrict users the write permissions for the CD/DVD but you must first create two OU's in your AD, for example the names for the OU's can be Restricted and Unrestricted, move the restricted users to the restricted OU and link this GPO to the restricted OU:

User Configuration\Policies\Administrative Templates\System\Removable Storage Access\CD and DVD: Deny Write Access

Take note that is a GPO for users and not for computer, so this apply only to the restricted OU.

Finally move the unrestricted users to the other OU so them take the default domain GPO or link the GPO of your preference.

If you have an internal security policies in a GPO you can use it as template to add the Deny Write Access DVD option.

1
  • Ok I think this will work, I'll have to test more on Monday, thanks for your help!
    – Jeff S.
    Sep 26, 2014 at 21:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .