Last week I showed you how to exclude an individual users from having a Group Policy Object (GPO) applied and this time I will show you how to properly apply a GPO to an individual user or computer. As I previously mentioned it is always best to use a security groups with GPO filtering even if you are only going applying it to a single user or computer. This avoids ever have to go back and modify the GPO security filtering if you need to add more object to the policy in the future.
Note: Before I start I should point out a common mistake here is to remove â€œAuthenticated Usersâ€ directory from the Security Filtering section on the Group Policy Object.
DONT DO THIS!!!
You should never do this as this however as this can cause â€œInaccessibleâ€ (see image below) error messages on Group Policy Objects in the Group Policy Management Console for anyone who is not an Domain Administrator. This happens because you have removed the ability to for the user to read contents GPO but donâ€™t worry this does not mean the policy will be applied to that user.
Step 1. Select the Group Policy Object in the Group Policy Management Console (GPMC) and the click on the â€œDelegationâ€ tab and then click on the â€œAdvancedâ€ button.
Step 2. Select the â€œAuthenticated Usersâ€ security group and then scroll down to the â€œApply Group Policyâ€ permission and un-tick the â€œAllowâ€ security setting.
Note: That the â€œAllowâ€ permission for â€œReadâ€ still needs to remain ticked as this prevents the Inaccessible message as mentioned above.
Step 3. Now click on the â€œAddâ€ button and select the group (recommended) that you want to have this policy apply. Then select the group (e.g. â€œAccounting Usersâ€) and scroll the permission list down to the â€œApply group policyâ€ option and then tick the â€œAllowâ€ permission.
This Group Policy will now only apply to users or computers that are a member of the Accounting Users security group. However you still need to remember that the user and/or computer still needs to located under the scope of the Group Policy Object for this policy to be applied.