SBS 2003 GPO setting exclusion
|
Prev: SBS2008 SP2
Next: DHCP, Scopes & VLANS
From: Jim on 11 Aug 2010 10:53 Hi Kerry, Tried that too, didn't work.. Is that because it's a user configuration settings as opposed to a computer configuration setting and I'm actually trying to exclude/deny a computer in the ACL security as such. You'd think this ought to be fairly simple but I've read so many conflicting things. I think it needs loopback to be involved somewhere so as to apply a user configuration settings back onto the the computer as such.. Anyone got any links to any info on this ? Basically we've modified the SBS Client Computer Policy so that under the user configuration settings the screensaver is turned on and set to a particular timeout. However we have a requirement for a certain PC to be excluded from these particular settings. Should we abandon trying to set this in the SBS Client Policy and setup a seperate Screensaver Policy ? And then use loopback processing ? As mentioned before I've had a bit of a forray into that earlier but it didn;t seem to want to work. Some pointers might be helpful. "Kerry Brown" wrote: > That should work. > > -- > Kerry Brown > MS-MVP - Windows Desktop Experience: Systems Administration > http://www.vistahelp.ca/phpBB2/ > > > "Jim" <Jim(a)discussions.microsoft.com> wrote in message > news:059E9A00-43EC-4B1F-AF35-6EBB6036E8E4(a)microsoft.com... > > Might security filtering be a better bet ? > > > > Create a seperate GPO for the screensaver settings and then exlude the > > particular PC through security filtering on that GPO ? > > > > > > "Jim" wrote: > > > >> Had a bit of a go at this...beginning to lose the will to live etc etc.. > >> > >> Followed some advice from elsewhere. > >> > >> Created a new security group 'Screensaver Disabled' and added the > >> particular > >> machine 'PC4' which we need to exclude the screensaver settings > >> from..rebooted PC4. > >> > >> I can see that the PC4 is now listed as a member of this security group.. > >> > >> Next up created a new GPO called 'No Screensaver' and linked it to: > >> > >> My Business>Computers>SBSComputers OU which contains the PC in question, > >> PC4, along with all the other PC's obviously.. > >> > >> Then on this particular GPO 'No Screensaver' removed the 'Authenticated > >> Users ' from the Delegation tab and added the security group 'Screensaver > >> Disabled' > >> > >> Then edit the GPO 'No Screensaver' to enable 'Computer > >> Configuration\Administrative Templates\System\Group Policies\User group > >> policy loopback processing mode' > >> and then set it to 'Replace' > >> > >> The edit the 'No Screensaver' GPO and 'Disable' the screensaver.. > >> > >> Update everything ans restart PC4... > >> > >> Hmm not working...still has screensaver enabled with settings as modified > >> in > >> SBS Client Computers GPO..ie Enabled, sspipes.scr and 90 seconds. > >> > >> Gpresult on PC4 returns info under the Computer policies section saying > >> that > >> 'No Screensaver' policy was not applied because it is Empty ??? > >> > >> Obviously took a wrong turn somewhere.. > >> > >> Anyone got any better ideas as to how to do this ? > >> > >> Just want to have screensaver policy which applies to all PC's on the SBS > >> domain apart from an individual machines which are excluded. > >> This needs to be machine based as opposed to user based though I am aware > >> that this is a user policy setting as such > >> > >> > >> > >> "Jim" wrote: > >> > >> > Probably set up another GP which reverses this setting ("disabled") or > >> > applies a different setting; link this to the correct OU (probably SBS > >> > Computers?) and apply policy filtering so it's only applied to that > >> > computer account. > >> > > >> > On Tue, 10 Aug 2010 12:33:03 -0700, Jim > >> > <Jim(a)discussions.microsoft.com> wrote: > >> > > >> > >We have modified one of the policy setting on the Small Business > >> > >Server > >> > >Client Computer policy to modify the screensaver setting, which is a > >> > >user > >> > >configuration setting. > >> > > > >> > >However we want to exclude one particular PC, which is based in a > >> > >reception > >> > >area, a static menu display screen, from this policy setting or if > >> > >need be > >> > >the whole policy. > >> > > > >> > >What is the best way of dealing with this ? > >> > > > >> > . > >> > > . >
From: Kerry Brown on 11 Aug 2010 11:38 I didn't realise that was a user setting. I should have checked. Yes, you'd need to put the computer in a separate OU and use loopback processing in a GPO in that OU. Note that when using loopback processing it's a good idea to set the deny read permission for that group policy for domain administrators. You can lock your self out of the computer if you don't. -- Kerry Brown MS-MVP - Windows Desktop Experience: Systems Administration http://www.vistahelp.ca/phpBB2/ "Jim" <Jim(a)discussions.microsoft.com> wrote in message news:4D87585D-811E-4702-8AD4-85D250E6F7AD(a)microsoft.com... > Hi Kerry, > > Tried that too, didn't work.. > > Is that because it's a user configuration settings as opposed to a > computer > configuration setting and I'm actually trying to exclude/deny a computer > in > the ACL security as such. > > You'd think this ought to be fairly simple but I've read so many > conflicting > things. > > I think it needs loopback to be involved somewhere so as to apply a user > configuration settings back onto the the computer as such.. > > Anyone got any links to any info on this ? > > Basically we've modified the SBS Client Computer Policy so that under the > user configuration settings the screensaver is turned on and set to a > particular timeout. > > However we have a requirement for a certain PC to be excluded from these > particular settings. > > Should we abandon trying to set this in the SBS Client Policy and setup a > seperate Screensaver Policy ? > > And then use loopback processing ? > > As mentioned before I've had a bit of a forray into that earlier but it > didn;t seem to want to work. > > Some pointers might be helpful. > > > > "Kerry Brown" wrote: > >> That should work. >> >> -- >> Kerry Brown >> MS-MVP - Windows Desktop Experience: Systems Administration >> http://www.vistahelp.ca/phpBB2/ >> >> >> "Jim" <Jim(a)discussions.microsoft.com> wrote in message >> news:059E9A00-43EC-4B1F-AF35-6EBB6036E8E4(a)microsoft.com... >> > Might security filtering be a better bet ? >> > >> > Create a seperate GPO for the screensaver settings and then exlude the >> > particular PC through security filtering on that GPO ? >> > >> > >> > "Jim" wrote: >> > >> >> Had a bit of a go at this...beginning to lose the will to live etc >> >> etc.. >> >> >> >> Followed some advice from elsewhere. >> >> >> >> Created a new security group 'Screensaver Disabled' and added the >> >> particular >> >> machine 'PC4' which we need to exclude the screensaver settings >> >> from..rebooted PC4. >> >> >> >> I can see that the PC4 is now listed as a member of this security >> >> group.. >> >> >> >> Next up created a new GPO called 'No Screensaver' and linked it to: >> >> >> >> My Business>Computers>SBSComputers OU which contains the PC in >> >> question, >> >> PC4, along with all the other PC's obviously.. >> >> >> >> Then on this particular GPO 'No Screensaver' removed the >> >> 'Authenticated >> >> Users ' from the Delegation tab and added the security group >> >> 'Screensaver >> >> Disabled' >> >> >> >> Then edit the GPO 'No Screensaver' to enable 'Computer >> >> Configuration\Administrative Templates\System\Group Policies\User >> >> group >> >> policy loopback processing mode' >> >> and then set it to 'Replace' >> >> >> >> The edit the 'No Screensaver' GPO and 'Disable' the screensaver.. >> >> >> >> Update everything ans restart PC4... >> >> >> >> Hmm not working...still has screensaver enabled with settings as >> >> modified >> >> in >> >> SBS Client Computers GPO..ie Enabled, sspipes.scr and 90 seconds. >> >> >> >> Gpresult on PC4 returns info under the Computer policies section >> >> saying >> >> that >> >> 'No Screensaver' policy was not applied because it is Empty ??? >> >> >> >> Obviously took a wrong turn somewhere.. >> >> >> >> Anyone got any better ideas as to how to do this ? >> >> >> >> Just want to have screensaver policy which applies to all PC's on the >> >> SBS >> >> domain apart from an individual machines which are excluded. >> >> This needs to be machine based as opposed to user based though I am >> >> aware >> >> that this is a user policy setting as such >> >> >> >> >> >> >> >> "Jim" wrote: >> >> >> >> > Probably set up another GP which reverses this setting ("disabled") >> >> > or >> >> > applies a different setting; link this to the correct OU (probably >> >> > SBS >> >> > Computers?) and apply policy filtering so it's only applied to that >> >> > computer account. >> >> > >> >> > On Tue, 10 Aug 2010 12:33:03 -0700, Jim >> >> > <Jim(a)discussions.microsoft.com> wrote: >> >> > >> >> > >We have modified one of the policy setting on the Small Business >> >> > >Server >> >> > >Client Computer policy to modify the screensaver setting, which is >> >> > >a >> >> > >user >> >> > >configuration setting. >> >> > > >> >> > >However we want to exclude one particular PC, which is based in a >> >> > >reception >> >> > >area, a static menu display screen, from this policy setting or if >> >> > >need be >> >> > >the whole policy. >> >> > > >> >> > >What is the best way of dealing with this ? >> >> > > >> >> > . >> >> > >> . >>
From: kj [SBS MVP] on 11 Aug 2010 14:29 Found recently that this works better using group policy preferences (registry settings) and item level targeting (computer or security group with computer members). In my case client had five different sets of screen saver computer groups all needing there own specific setting. Moveing them into sperate OU's wasn't an option.and some undesireable loopback processing side effects Workstations all need to support group policy preferences by OS and required patches of course. Kerry Brown wrote: > I didn't realise that was a user setting. I should have checked. Yes, > you'd need to put the computer in a separate OU and use loopback > processing in a GPO in that OU. Note that when using loopback > processing it's a good idea to set the deny read permission for that > group policy for domain administrators. You can lock your self out of > the computer if you don't. > > "Jim" <Jim(a)discussions.microsoft.com> wrote in message > news:4D87585D-811E-4702-8AD4-85D250E6F7AD(a)microsoft.com... >> Hi Kerry, >> >> Tried that too, didn't work.. >> >> Is that because it's a user configuration settings as opposed to a >> computer >> configuration setting and I'm actually trying to exclude/deny a >> computer in >> the ACL security as such. >> >> You'd think this ought to be fairly simple but I've read so many >> conflicting >> things. >> >> I think it needs loopback to be involved somewhere so as to apply a >> user configuration settings back onto the the computer as such.. >> >> Anyone got any links to any info on this ? >> >> Basically we've modified the SBS Client Computer Policy so that >> under the user configuration settings the screensaver is turned on >> and set to a particular timeout. >> >> However we have a requirement for a certain PC to be excluded from >> these particular settings. >> >> Should we abandon trying to set this in the SBS Client Policy and >> setup a seperate Screensaver Policy ? >> >> And then use loopback processing ? >> >> As mentioned before I've had a bit of a forray into that earlier but >> it didn;t seem to want to work. >> >> Some pointers might be helpful. >> >> >> >> "Kerry Brown" wrote: >> >>> That should work. >>> >>> -- >>> Kerry Brown >>> MS-MVP - Windows Desktop Experience: Systems Administration >>> http://www.vistahelp.ca/phpBB2/ >>> >>> >>> "Jim" <Jim(a)discussions.microsoft.com> wrote in message >>> news:059E9A00-43EC-4B1F-AF35-6EBB6036E8E4(a)microsoft.com... >>>> Might security filtering be a better bet ? >>>> >>>> Create a seperate GPO for the screensaver settings and then exlude >>>> the particular PC through security filtering on that GPO ? >>>> >>>> >>>> "Jim" wrote: >>>> >>>>> Had a bit of a go at this...beginning to lose the will to live etc >>>>> etc.. >>>>> >>>>> Followed some advice from elsewhere. >>>>> >>>>> Created a new security group 'Screensaver Disabled' and added the >>>>> particular >>>>> machine 'PC4' which we need to exclude the screensaver settings >>>>> from..rebooted PC4. >>>>> >>>>> I can see that the PC4 is now listed as a member of this security >>>>> group.. >>>>> >>>>> Next up created a new GPO called 'No Screensaver' and linked it >>>>> to: My Business>Computers>SBSComputers OU which contains the PC in >>>>> question, >>>>> PC4, along with all the other PC's obviously.. >>>>> >>>>> Then on this particular GPO 'No Screensaver' removed the >>>>> 'Authenticated >>>>> Users ' from the Delegation tab and added the security group >>>>> 'Screensaver >>>>> Disabled' >>>>> >>>>> Then edit the GPO 'No Screensaver' to enable 'Computer >>>>> Configuration\Administrative Templates\System\Group Policies\User >>>>> group >>>>> policy loopback processing mode' >>>>> and then set it to 'Replace' >>>>> >>>>> The edit the 'No Screensaver' GPO and 'Disable' the screensaver.. >>>>> >>>>> Update everything ans restart PC4... >>>>> >>>>> Hmm not working...still has screensaver enabled with settings as >>>>> modified >>>>> in >>>>> SBS Client Computers GPO..ie Enabled, sspipes.scr and 90 seconds. >>>>> >>>>> Gpresult on PC4 returns info under the Computer policies section >>>>> saying >>>>> that >>>>> 'No Screensaver' policy was not applied because it is Empty ??? >>>>> >>>>> Obviously took a wrong turn somewhere.. >>>>> >>>>> Anyone got any better ideas as to how to do this ? >>>>> >>>>> Just want to have screensaver policy which applies to all PC's on >>>>> the SBS >>>>> domain apart from an individual machines which are excluded. >>>>> This needs to be machine based as opposed to user based though I >>>>> am aware >>>>> that this is a user policy setting as such >>>>> >>>>> >>>>> >>>>> "Jim" wrote: >>>>> >>>>>> Probably set up another GP which reverses this setting >>>>>> ("disabled") or >>>>>> applies a different setting; link this to the correct OU >>>>>> (probably SBS >>>>>> Computers?) and apply policy filtering so it's only applied to >>>>>> that computer account. >>>>>> >>>>>> On Tue, 10 Aug 2010 12:33:03 -0700, Jim >>>>>> <Jim(a)discussions.microsoft.com> wrote: >>>>>> >>>>>>> We have modified one of the policy setting on the Small Business >>>>>>> Server >>>>>>> Client Computer policy to modify the screensaver setting, which >>>>>>> is a >>>>>>> user >>>>>>> configuration setting. >>>>>>> >>>>>>> However we want to exclude one particular PC, which is based in >>>>>>> a reception >>>>>>> area, a static menu display screen, from this policy setting or >>>>>>> if need be >>>>>>> the whole policy. >>>>>>> >>>>>>> What is the best way of dealing with this ? >>>>>>> >>>>>> . >>>>>> >>> . -- /kj
From: Jim on 11 Aug 2010 15:59 Hi KJ, Yes, I've found it somewhat unpredictable too.. Where's a good resource on the method which you are describing ? Also...what's all this about needing to jump ship to a new board ? Jim. "kj [SBS MVP]" wrote: > Found recently that this works better using group policy preferences > (registry settings) and item level targeting (computer or security group > with computer members). In my case client had five different sets of screen > saver computer groups all needing there own specific setting. Moveing them > into sperate OU's wasn't an option.and some undesireable loopback processing > side effects > > Workstations all need to support group policy preferences by OS and required > patches of course. > > > Kerry Brown wrote: > > I didn't realise that was a user setting. I should have checked. Yes, > > you'd need to put the computer in a separate OU and use loopback > > processing in a GPO in that OU. Note that when using loopback > > processing it's a good idea to set the deny read permission for that > > group policy for domain administrators. You can lock your self out of > > the computer if you don't. > > > > "Jim" <Jim(a)discussions.microsoft.com> wrote in message > > news:4D87585D-811E-4702-8AD4-85D250E6F7AD(a)microsoft.com... > >> Hi Kerry, > >> > >> Tried that too, didn't work.. > >> > >> Is that because it's a user configuration settings as opposed to a > >> computer > >> configuration setting and I'm actually trying to exclude/deny a > >> computer in > >> the ACL security as such. > >> > >> You'd think this ought to be fairly simple but I've read so many > >> conflicting > >> things. > >> > >> I think it needs loopback to be involved somewhere so as to apply a > >> user configuration settings back onto the the computer as such.. > >> > >> Anyone got any links to any info on this ? > >> > >> Basically we've modified the SBS Client Computer Policy so that > >> under the user configuration settings the screensaver is turned on > >> and set to a particular timeout. > >> > >> However we have a requirement for a certain PC to be excluded from > >> these particular settings. > >> > >> Should we abandon trying to set this in the SBS Client Policy and > >> setup a seperate Screensaver Policy ? > >> > >> And then use loopback processing ? > >> > >> As mentioned before I've had a bit of a forray into that earlier but > >> it didn;t seem to want to work. > >> > >> Some pointers might be helpful. > >> > >> > >> > >> "Kerry Brown" wrote: > >> > >>> That should work. > >>> > >>> -- > >>> Kerry Brown > >>> MS-MVP - Windows Desktop Experience: Systems Administration > >>> http://www.vistahelp.ca/phpBB2/ > >>> > >>> > >>> "Jim" <Jim(a)discussions.microsoft.com> wrote in message > >>> news:059E9A00-43EC-4B1F-AF35-6EBB6036E8E4(a)microsoft.com... > >>>> Might security filtering be a better bet ? > >>>> > >>>> Create a seperate GPO for the screensaver settings and then exlude > >>>> the particular PC through security filtering on that GPO ? > >>>> > >>>> > >>>> "Jim" wrote: > >>>> > >>>>> Had a bit of a go at this...beginning to lose the will to live etc > >>>>> etc.. > >>>>> > >>>>> Followed some advice from elsewhere. > >>>>> > >>>>> Created a new security group 'Screensaver Disabled' and added the > >>>>> particular > >>>>> machine 'PC4' which we need to exclude the screensaver settings > >>>>> from..rebooted PC4. > >>>>> > >>>>> I can see that the PC4 is now listed as a member of this security > >>>>> group.. > >>>>> > >>>>> Next up created a new GPO called 'No Screensaver' and linked it > >>>>> to: My Business>Computers>SBSComputers OU which contains the PC in > >>>>> question, > >>>>> PC4, along with all the other PC's obviously.. > >>>>> > >>>>> Then on this particular GPO 'No Screensaver' removed the > >>>>> 'Authenticated > >>>>> Users ' from the Delegation tab and added the security group > >>>>> 'Screensaver > >>>>> Disabled' > >>>>> > >>>>> Then edit the GPO 'No Screensaver' to enable 'Computer > >>>>> Configuration\Administrative Templates\System\Group Policies\User > >>>>> group > >>>>> policy loopback processing mode' > >>>>> and then set it to 'Replace' > >>>>> > >>>>> The edit the 'No Screensaver' GPO and 'Disable' the screensaver.. > >>>>> > >>>>> Update everything ans restart PC4... > >>>>> > >>>>> Hmm not working...still has screensaver enabled with settings as > >>>>> modified > >>>>> in > >>>>> SBS Client Computers GPO..ie Enabled, sspipes.scr and 90 seconds. > >>>>> > >>>>> Gpresult on PC4 returns info under the Computer policies section > >>>>> saying > >>>>> that > >>>>> 'No Screensaver' policy was not applied because it is Empty ??? > >>>>> > >>>>> Obviously took a wrong turn somewhere.. > >>>>> > >>>>> Anyone got any better ideas as to how to do this ? > >>>>> > >>>>> Just want to have screensaver policy which applies to all PC's on > >>>>> the SBS > >>>>> domain apart from an individual machines which are excluded. > >>>>> This needs to be machine based as opposed to user based though I > >>>>> am aware > >>>>> that this is a user policy setting as such > >>>>> > >>>>> > >>>>> > >>>>> "Jim" wrote: > >>>>> > >>>>>> Probably set up another GP which reverses this setting > >>>>>> ("disabled") or > >>>>>> applies a different setting; link this to the correct OU > >>>>>> (probably SBS > >>>>>> Computers?) and apply policy filtering so it's only applied to > >>>>>> that computer account. > >>>>>> > >>>>>> On Tue, 10 Aug 2010 12:33:03 -0700, Jim > >>>>>> <Jim(a)discussions.microsoft.com> wrote: > >>>>>> > >>>>>>> We have modified one of the policy setting on the Small Business > >>>>>>> Server > >>>>>>> Client Computer policy to modify the screensaver setting, which > >>>>>>> is a > >>>>>>> user > >>>>>>> configuration setting. > >>>>>>> > >>>>>>> However we want to exclude one particular PC, which is based in > >>>>>>> a reception > >>>>>>> area, a static menu display screen, from this policy setting or > >>>>>>> if need be > >>>>>>> the whole policy. > >>>>>>> > >>>>>>> What is the best way of dealing with this ? > >>>>>>> > >>>>>> . > >>>>>> > >>> . > > -- > /kj > > > . >
From: kj [SBS MVP] on 11 Aug 2010 16:59
Jim wrote: > Hi KJ, > > Yes, I've found it somewhat unpredictable too.. Well it is predicatble, but may not be desireable when the user and the computer are in different OU's and there are user policy settings. Loopbacks can result in predictable, but unintended results. > > Where's a good resource on the method which you are describing ? Group policy *preferences* in technet make for a good read. You need to use a Win7 (Vista, or 2008+) GPO managment and then explore the registery settings. HKCU is a workable registery setting and where the Screen Saver settings are needed. The next tidbit is the "item level targeting" feature of preferences. Basically you are targeting the preference settings at one of the many filterable objects - kinda like a WMI filter without the overhead and difficulty. Item level targeting should also be covered at least to some degree in the Technet Article. In this case you would item level target a computer account or a security group with the computer account as a group member. > > Also...what's all this about needing to jump ship to a new board ? Newsgroups are closing down. Thought they had already. You will want to switch over to the forums. For SBS see my sig line below. -- -- Please visit Microsoft SBS Technet Forum; http://social.technet.microsoft.com/Forums/en-US/smallbusinessserver/threads--/kj>> Jim.>> "kj [SBS MVP]" wrote:>>> Found recently that this works better using group policy preferences>> (registry settings) and item level targeting (computer or security>> group with computer members). In my case client had five different>> sets of screen saver computer groups all needing there own specific>> setting. Moveing them into sperate OU's wasn't an option.and some>> undesireable loopback processing side effects>>>> Workstations all need to support group policy preferences by OS and>> required patches of course.>>>>>> Kerry Brown wrote:>>> I didn't realise that was a user setting. I should have checked.>>> Yes, you'd need to put the computer in a separate OU and use>>> loopback processing in a GPO in that OU. Note that when using>>> loopback processing it's a good idea to set the deny read>>> permission for that group policy for domain administrators. You can>>> lock your self out of the computer if you don't.>>>>>> "Jim" <Jim(a)discussions.microsoft.com> wrote in message>>> news:4D87585D-811E-4702-8AD4-85D250E6F7AD(a)microsoft.com...>>>> Hi Kerry,>>>>>>>> Tried that too, didn't work..>>>>>>>> Is that because it's a user configuration settings as opposed to a>>>> computer>>>> configuration setting and I'm actually trying to exclude/deny a>>>> computer in>>>> the ACL security as such.>>>>>>>> You'd think this ought to be fairly simple but I've read so many>>>> conflicting>>>> things.>>>>>>>> I think it needs loopback to be involved somewhere so as to apply a>>>> user configuration settings back onto the the computer as such..>>>>>>>> Anyone got any links to any info on this ?>>>>>>>> Basically we've modified the SBS Client Computer Policy so that>>>> under the user configuration settings the screensaver is turned on>>>> and set to a particular timeout.>>>>>>>> However we have a requirement for a certain PC to be excluded from>>>> these particular settings.>>>>>>>> Should we abandon trying to set this in the SBS Client Policy and>>>> setup a seperate Screensaver Policy ?>>>>>>>> And then use loopback processing ?>>>>>>>> As mentioned before I've had a bit of a forray into that earlier>>>> but it didn;t seem to want to work.>>>>>>>> Some pointers might be helpful.>>>>>>>>>>>>>>>> "Kerry Brown" wrote:>>>>>>>>> That should work.>>>>>>>>>> -->>>>> Kerry Brown>>>>> MS-MVP - Windows Desktop Experience: Systems Administration>>>>> http://www.vistahelp.ca/phpBB2/>>>>>>>>>>>>>>> "Jim" <Jim(a)discussions.microsoft.com> wrote in message>>>>> news:059E9A00-43EC-4B1F-AF35-6EBB6036E8E4(a)microsoft.com...>>>>>> Might security filtering be a better bet ?>>>>>>>>>>>> Create a seperate GPO for the screensaver settings and then>>>>>> exlude the particular PC through security filtering on that GPO ?>>>>>>>>>>>>>>>>>> "Jim" wrote:>>>>>>>>>>>>> Had a bit of a go at this...beginning to lose the will to live>>>>>>> etc etc..>>>>>>>>>>>>>> Followed some advice from elsewhere.>>>>>>>>>>>>>> Created a new security group 'Screensaver Disabled' and added>>>>>>> the particular>>>>>>> machine 'PC4' which we need to exclude the screensaver settings>>>>>>> from..rebooted PC4.>>>>>>>>>>>>>> I can see that the PC4 is now listed as a member of this>>>>>>> security group..>>>>>>>>>>>>>> Next up created a new GPO called 'No Screensaver' and linked it>>>>>>> to: My Business>Computers>SBSComputers OU which contains the PC>>>>>>> in question,>>>>>>> PC4, along with all the other PC's obviously..>>>>>>>>>>>>>> Then on this particular GPO 'No Screensaver' removed the>>>>>>> 'Authenticated>>>>>>> Users ' from the Delegation tab and added the security group>>>>>>> 'Screensaver>>>>>>> Disabled'>>>>>>>>>>>>>> Then edit the GPO 'No Screensaver' to enable 'Computer>>>>>>> Configuration\Administrative Templates\System\Group>>>>>>> Policies\User group>>>>>>> policy loopback processing mode'>>>>>>> and then set it to 'Replace'>>>>>>>>>>>>>> The edit the 'No Screensaver' GPO and 'Disable' the>>>>>>> screensaver..>>>>>>>>>>>>>> Update everything ans restart PC4...>>>>>>>>>>>>>> Hmm not working...still has screensaver enabled with settings as>>>>>>> modified>>>>>>> in>>>>>>> SBS Client Computers GPO..ie Enabled, sspipes.scr and 90>>>>>>> seconds.>>>>>>>>>>>>>> Gpresult on PC4 returns info under the Computer policies section>>>>>>> saying>>>>>>> that>>>>>>> 'No Screensaver' policy was not applied because it is Empty ???>>>>>>>>>>>>>> Obviously took a wrong turn somewhere..>>>>>>>>>>>>>> Anyone got any better ideas as to how to do this ?>>>>>>>>>>>>>> Just want to have screensaver policy which applies to all PC's>>>>>>> on the SBS>>>>>>> domain apart from an individual machines which are excluded.>>>>>>> This needs to be machine based as opposed to user based though I>>>>>>> am aware>>>>>>> that this is a user policy setting as such>>>>>>>>>>>>>>>>>>>>>>>>>>>> "Jim" wrote:>>>>>>>>>>>>>>> Probably set up another GP which reverses this setting>>>>>>>> ("disabled") or>>>>>>>> applies a different setting; link this to the correct OU>>>>>>>> (probably SBS>>>>>>>> Computers?) and apply policy filtering so it's only applied to>>>>>>>> that computer account.>>>>>>>>>>>>>>>> On Tue, 10 Aug 2010 12:33:03 -0700, Jim>>>>>>>> <Jim(a)discussions.microsoft.com> wrote:>>>>>>>>>>>>>>>>> We have modified one of the policy setting on the Small>>>>>>>>> Business Server>>>>>>>>> Client Computer policy to modify the screensaver setting,>>>>>>>>> which is a>>>>>>>>> user>>>>>>>>> configuration setting.>>>>>>>>>>>>>>>>>> However we want to exclude one particular PC, which is based>>>>>>>>> in a reception>>>>>>>>> area, a static menu display screen, from this policy setting>>>>>>>>> or if need be>>>>>>>>> the whole policy.>>>>>>>>>>>>>>>>>> What is the best way of dealing with this ?>>>>>>>>>>>>>>>>> .>>>>>>>>>>>>> .>>>> -->> /kj>>>>>> .--/kj |