0

Not sure if this would be the right place to ask this. On my domain controllers, I have created all my users and computers inside an OU. I have a group named Support which is in the local admins group on the users machines. Authenticated users are set not to be able to access control panel nor to be able to read or write to the CD/DVD drive. Another policy I have another policy entitled "User Support" which allows access to the CD/DVD drive and Control Panel which is scoped to the Support group whereas my basic user policy is scoped to the authenticated user group. I figure that enabling the policy to deny the user access on the CD/DVD drive for authenticated users may conflict with this same option being disabled for the support group but, now, even users who are no longer in the support group can access the CD/DVD drive. What do I need to do to fix this

migrated from superuser.com Feb 12 '16 at 14:51

This question came from our site for computer enthusiasts and power users.

1

As the solution from Noor will work, you'll be forced to constantly update that group, which I guess is like 90% of the users of the domain. Instead, you can deny the policy for the "User support" group.

You just need one GPO for this, the one you're using for Authenticated Users, keep this one, and delete the other one.

Now you need to deny this policy to your "User Support" group: go to the Group Policy Management Console, click on your policy, select the "Delegation" tab, click on the button "Advanced..." (it's on the bottom-right corner of the window), then "Add...", find and select your group, and when added, scroll the permissions, you'll find "Apply group policy", select the checkbox for "Deny". Way to go :D

1

Don't filter permissions using the "Authenticated Users" group, that will cause a problem and your policies will not be applied correctly.

Instead, create a security group for the users that you want to apply the "hide control panel" option to and scope your policy using that group.

For further information, read here: https://technet.microsoft.com/en-us/library/cc752992.aspx

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.