I got 5 servers where i need to lock them down so as standard there is only read only access to the C drive and a couple of other servers where full admin access is required all the time. There is a need however that out of the 5 servers that are locked down all the time a user can request access and they be moved into an approved security group for that server.

I have created an OU group for each server and inside that OU there is an approved and denied policy along with a approved security group and a denied security group. I have taken off the authenticated users off each policy and applied only the security group that relates to the policy and the server.

The problem i am facing is this,

If i assign a user to the denied group for server 1 and the approved security group for server 2 - the approved rights for server 2 are also applied to server 1. It does not matter how many restricted groups a user is in, if i apply even 1 of of approved group it applies to all servers.

I have set each policy to enforced and linked and have listed them in the following order.

  • Server1Denied
  • Server2Denied
  • etc..

  • Server1Approved

  • Server2Approved
  • etc...

Hopefully this is something simple so sorry if its a silly thing - sadly it has been a while sense i have done anything with group policy.



I'm guessing you are using Group Policy so that you don't need to set group membership individually on each server? For example. you could achieve what you're trying to do by having an "administrative" global group for each server, and a "non-administrative" group for each server. The administrative group could then be placed in the administrators local group on the server at build time, and the non-administrative group could be placed in the local users group on the server at build time. Both groups could then be assigned the "allow logon locally" privilege.

However, if you're using GPO preferences with the "Local Users and Groups" option, I'd personally create five GPO preference policies, each with a WMI filter ensuring that the policy only applies the given server.

You could then achieve the stuff above, but from a central location, without the "at build time" constraints...

Hope this helps.

  • That is correct, I have a default policy running and then an approved and denied policy for each server that are linked to the default policy. I will give the WMI filtering a try and see how i get on. – needmorebeerformewallaby Aug 13 '12 at 8:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.