Enforcing Group Policy

Written by on Wednesday, March 5, 2008 5:25 - 0 Comments
How to force Group Policy to apply even when users can override settings using local admin credentials.
Users who have local admin accounts on workstations can edit the registry and thereby undo many Group Policy settings that may have been applied to their computers. Best practice then would be to not give users local admin privileges on their workstations, but sometimes this is not practical. For example, some third-party line of business software will only install and run properly under admin creds.

So what can a sysadmin do to prevent such users from overriding Group Policy? One thing you can do is to go to the following node in your Group Policy Object:

Computer Configuration Administrative Templates System Group Policy

Then look for any policies that end in “…policy processing” and open these policies and select the checkbox that says “Process even if the Group Policy objects have not changed”. This will *force* these policies to *always* be applied whether or not any settings in the GPO have actually changed or not. That way, for example, if a user edits their registry to change a wireless setting, the next time Group Policy is refreshed in the background any change they made will be undone.

<!– <<


Article written by MyComputerAid.com

Leave a Reply

You must be logged in to post a comment.

2003 server - Sep 30, 2008 22:34 - 0 Comments

instant messaging srv records

More In Computers & PC

Microsoft Outlook - Mar 22, 2009 11:22 - 0 Comments

Outlook: Duplicates in Mailbox

More In Computers & PC