deny computer gpo to specific user account

Question

I have a Computer GPO that I need to deny apply when a specific User logs into a machine.

I have tried using the Deny Apply setting in delegation for the users account but it still applies the settings.

How can I deny a computer GPO to a any computer in the domain when a specific user logs into that computer?

Computer policy settings are applied by the computer account itself, and generally don't care about the user account (for example, computer policies can apply before any user logs in). Depending on the actual setting, you may have options like client-side targeting for preferences, or there may be a similar User policy setting you can switch it out for. Otherwise, you might be able to use loopback processing to only apply that policy when the user is not your excluded user. — Cpt.Whale, Commented Apr 15 at 16:24
You cannot deny a Computer Policy based on a user login. A computer will process the Computer Policy part of the GPO before any user tries to log on. — Silbee, Commented Apr 16 at 10:48

M. Behrens · Accepted Answer · 2024-04-15 16:25:21Z

1

Since computer policies apply globally to the computer, there is no way to apply filters to users. They are applied before any user log on.

answered Apr 15 at 16:25

M. Behrens

1,0503 silver badges8 bronze badges

thank you. that's what i was thinking as well and afraid of. thank you for confirming.
– NuckinFutz
Commented Apr 15 at 16:40

Add a comment |

1 Answer 1