Where am I going wrong with the below?
We have a server running Server 2008 R2 which users connect to via remote desktop to run a CRM application.
This server has SQL Server 2012 installed, along with Management Studio.
Users in the Domain Admins group need access to management studio. Non-admin users should not be able to even open SQL management studio.
I have created an OU on the domain controller with this server (TSERVER) as the only object. In this OU, I have created a group policy with ssms.exe in the list of disallowed applications.
In Delegation, I have Authenticated users set to Apply Group Policy, and for Domain Admins group, I have denied Apply Group Policy.
Even after running
gpupdate /force on as the Administrator on TSERVER, the policy still doesn't apply, and users can still open SQL Management Studio.
I am pretty sure it's a basic setting I'm not applying.