• This article is only available to registered users. Sign up now and get instant access!
  • [October 1, 2001]
  • Access Denied: Group Policy and the Administrator Account
  • By:  Randy Franklin Smith
  • Access Denied
  • InstantDoc #22315
  • Web Exclusive from Windows IT Pro

I need to prevent group policy from being applied to the Administrator group on my local machines. I know that I can add permissions to the Group Policy Object's (GPO's) ACL to deny Apply Group Policy access to the Administrator account. Must I have a Windows 2000 Active Directory (AD) server? (I won't have a Win2K server in my Windows NT domain when I roll out the desktops.)

To take full advantage of Win2K's new security and management features, you need to implement AD. Win2K Professional computers by themselves offer few advances beyond easier installation and better device recognition. In your situation, without AD installed, the only GPOs applied are the local GPOs on each computer. Each computer's local GPO is applied whenever the computer boots or someone logs on. Unfortunately, you can't shield administrators from the policies defined in local GPOs.

End of Article


You must log on before posting a comment.

If you don't have a username & password, please register now.

Reader Comments

<br><br> Yes you can deny this. Just change NTFS permissions in the policy file itself and deny access to the administrator and he will not get the local policy applied while all other users will.<br>

Claudio Rodrigues- September 20, 2002

<br><br> I believe you can deny access to the Group Policy folder on each machine to the Administrator or Administrator Group. This is done AFTER the policy is created and saved. If the policy needs to be changed, just give the Administrator all rights once again, make changes, then take away all rights.<br>

Wendy- September 30, 2002

<br><br> I beg to differ: check out Microsoft's KB article Q293655. This details how to set up local policies to apply to all users except the Admins. Kinda have to "trick" the computer...<br>

Craig- October 08, 2002