I have an request to apply computer policy changes to a specific set of users. For example, I want a specific windows feature (Allow Cortana) available to members of a security group (CortanaUsers).

My first internet search showed me examples of how to set up an OU and attach a group policy object that only applied to that OU to enabled Computer policies. I discovered that computers needed to be manually added to the OU (as adding a group of computers did not expose the policy via a pushed update or users running gpupdate on those computers). This solution was not well received because a computer can only exist in on OU at a time.

Subsequently I found advice to add a security group with computers to the root OU, and have the policy applied last. This too was not well received because it required upfront knowledge of which computers the users would be using.

Finally it was recommended to me to have a log-on script execute (with local admin permission) that modified computer policy settings by seeing if the logged in user had membership in a security group. That way the feature would be enabled or disabled based on who logged in with what computer. I am not an expert at how roaming profiles or such scripts work.

I want to be able to apply computer policies for a security group of users. What is the best way to do that?

closed as off-topic by Greg Askew, Dave M, bodgit, Ward Jan 12 at 5:37

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions should demonstrate reasonable business information technology management practices. Questions that relate to unsupported hardware or software platforms or unmaintained environments may not be suitable for Server Fault - see the help center." – Greg Askew, Ward
If this question can be reworded to fit the rules in the help center, please edit the question.

  • Given the constraints you've outlined, it can't be done. Windows simply isn't designed to do what you're asking for. I suppose you could hire someone to build you some sort of ramshackle solution, and it might even work (and if you're really lucky it might even keep working after the next Windows update) but I reckon you'd be looking at a price tag in the thousands of dollars - is it really that important? – Harry Johnston Dec 25 '18 at 9:46

It’s not very clear what you’re asking.

The policy you reference, “allow Cortana” is a computer policy. The description is:

This policy setting specifies whether Cortana is allowed on the device. If you enable or don’t configure this setting, Cortana will be allowed on the device. If you disable this setting, Cortana will be turned off. When Cortana is off, users will still be able to use search to find things on the device and on the Internet.

As stated, this setting decides if Cortana will be allowed “on the device.”

First, computer policies apply to computers. User policies apply to users. There is no mixing of the two. Computer policies affect all users on a single computer. User policies affect a single user on any computer.

If you want to apply a user policy to all users of a specific computer, then you use what’s called “group policy loopback processing.” You apply a “user” policy to a specific OU containing computers. In that policy you enable the group policy loopback processing mode. Any user who logs on to those computers will get the user policy.

If you want to filter a policy that applies to an entire OU but limit the policy to a specific subset of users or computers within that OU then you use security settings or WMI filtering. In order for a policy to apply to a user or computer both have to have “read” and “apply” permissions on the policy. With WMI filtering you can limit a policy so that it only applies to a very specific set of users or computers based on just about any variable you can think of: OS version, RAM amount, Chassis style, registry key, etc.

Additionally, if the policy is a “group policy preference” policy, you can enable item-level targeting and filter a policy’s application based on many of the same settings WMI filtering works with.

I’ve given you all the terms you need to find the information to do what you want to do. But, like I said, computer policies affect all users on a computer. If your intention is to apply a computer policy that affects all users, for instance, turning off the firewall, but you want it to only apply to a subset of users of that computer, you can’t. You’re looking at your problem wrong and trying to solve it the wrong way. You can not disable Cortana “on the device” then expect it to work for some users.

  • Thanks for your response. This setting seems to apply to computers, not users. I' restated my ask, which is, I want to allow a device setting (computer policy) for a security group (of users). Cheers, – Micromuncher Dec 25 '18 at 7:59
  • @Micromuncher as mentioned. You can’t. If your goal is to dynamically enable and disable Cortana for different users logging on to the same computer using that policy, you can’t. If, say, your users stayed on the same computer and weren’t moving all around then it would be more doable. But you indicated that isn’t the case. – Appleoddity Dec 25 '18 at 14:13

Not the answer you're looking for? Browse other questions tagged or ask your own question.