EXPERT RESPONSE
I'm hoping by "workgroup" you mean that you all "work together"; that is,
you don't mean "workgroup" in the "I'm using Windows in a Workgroup
configuration" sense. Instead, let's call them our "OU Administrators." So,
if you want to restrict Control Panel access to all users in an OU, but
"pass over" the GPO from processing for our OU Administrators, it's a two
step process.
First, create the GPO and apply it to the OU to restrict the
Control Panel. The policy setting you're after is User Configuration |
Administrative Templates | Control Panel then enable the "Prohibit access to
the Control Panel." Then, use "Security Filtering" upon the GPO you create.
At this point, you have two options: you can add all the user accounts you
want to get the GPO to a Windows security group, and ensure they get the
"Read" and "Apply Group Policy" permissions upon the GPO. Or, you can add
all the user accounts you DON'T want to get the GPO and DENY them the
ability to "Apply Group Policy" permission.
Note: If you have my Windows 2000: Group Policy, Profiles and IntellMirror
text, you can see how to do this on Page 48-50.
|
