Internet Explorer GPO settings SOM??

Internet Explorer GPO SOM??

I've successfully configured a policy that prevents user from accessing the
Internet Explorer menu “Tools\Internet Options� and some other menu’s. The
policy is linked to a specific OU.

The problem is that this policy is applying also to the local Administrator
user in all the computers in the domain and this is not what I want.

What’s the SOM for the IE policies settings that are under the user level?
How can I change this?

Thanks in advance,

=?Utf-8?B?QWx2YXJvIFNvdG8=?=

"Alvaro Soto" <> wrote in message
news:FCA63569-2306-4348-B0E7-...
> Internet Explorer GPO SOM??
>
> I've successfully configured a policy that prevents user from accessing
> the
> Internet Explorer menu “Tools\Internet Options� and some other menu’s. The
> policy is linked to a specific OU.
>
> The problem is that this policy is applying also to the local
> Administrator
> user in all the computers in the domain and this is not what I want.
>
> What’s the SOM for the IE policies settings that are under the user level?
> How can I change this?
>
> Thanks in advance,
>
Couple of things:
1. This newsgroup is called "microsoft.public.cert.exam.mcse", it's used for
people to ask questions about MCSE exam topics.
2. Did you bother doing any research of your own first?

Wayne McGlinn
Brisbane, Oz
MCNGP Silver
MCP Win95

Wayne McGlinn

"Alvaro Soto" wrote:

> The problem is that this policy is applying also to the local Administrator
> user in all the computers in the domain and this is not what I want.
>

What do ya mean by "...the local Administrator..."? If you are logging in
as a local administrator, you are not in the domain any more. Therefore, GOP
wouldn't apply to local workstations anyway. But if you meant that when you
try to log in computers in the domain using Administrator account, then some
how your admin account has been included in the GOP. By the way, it's a big
NO NO for keeping and using the default Administrator account because of the
security purposes.

=?Utf-8?B?RHJhZ29uIFdpdGhvdXQgV2luZ3M=?=

>Therefore, GOP wouldn't apply to local workstations anyway.



Yeah... I hate it when the Republicans get control of my workstation.

Jtyc

Dragon Without Wings wrote:
>
> "Alvaro Soto" wrote:
>
>> The problem is that this policy is applying also to the local Administrator
>> user in all the computers in the domain and this is not what I want.
>>
>
> What do ya mean by "...the local Administrator..."? If you are logging in
> as a local administrator, you are not in the domain any more. Therefore, GOP
> wouldn't apply to local workstations anyway. But if you meant that when you
> try to log in computers in the domain using Administrator account, then some
> how your admin account has been included in the GOP. By the way, it's a big
> NO NO for keeping and using the default Administrator account because of the
> security purposes.

You can apply Group Policy even for local users by setting "Group Policy
loopback processing" in Computer configuration->Administrative
templates->System->Group Policy. And domain GPOs have more priority on
Local Policies. And there is now way to make Local PO "No override",
like you may do with GPO.

Maxim M. Kazachek

"Maxim M. Kazachek" wrote:

>
> You can apply Group Policy even for local users by setting "Group Policy
> loopback processing" >

This will hold true only when he still log in using a domain account. If he
is logging in the workstation locally, no GPO will be applied (I mean at
domain level). However, you just make an interesting point. If some how he
accidentally enable the GPO loopback processing, everyone will have the same
affect by that GPO because the GPO now applied only on which computer the
user logs on to

=?Utf-8?B?RHJhZ29uIFdpdGhvdXQgV2luZ3M=?=

GPO overriedes any other security levels. GPO is set at site or domain
level. Which means you will have to configure security locally on
workstations.

"Dragon Without Wings" wrote:

>
> "Maxim M. Kazachek" wrote:
>
> >
> > You can apply Group Policy even for local users by setting "Group Policy
> > loopback processing" >
>
> This will hold true only when he still log in using a domain account. If he
> is logging in the workstation locally, no GPO will be applied (I mean at
> domain level). However, you just make an interesting point. If some how he
> accidentally enable the GPO loopback processing, everyone will have the same
> affect by that GPO because the GPO now applied only on which computer the
> user logs on to

=?Utf-8?B?bWFu?=