How Security Filtering Works
Security group filtering can be inclusive as well as
exclusive. Thus, you can prevent a GPO from applying to a certain group, or
you can create a GPO that applies only to a certain security group. To employ
security filtering, use the Security tab of a given GPO to set access
permissions — that is, discretionary access control lists (DACLs) — to allow
or deny access to the GPO by specified groups.
By default, all GPOs that have been linked to a site,
domain, or OU affect all users and computers that are contained in the linked
site, domain, or OU and any child OUs. By changing the Access Control Entries
(ACEs) within a DACL, the effect of any GPO can be modified to exclude or
include the members of any security group.
For a GPO to apply to a group, user, or computer, both
Apply Group Policy and Read ACEs must be set to Allow. By default, both the
Apply Group Policy and Read ACE permissions are set to Allow for Authenticated
Users. Everyone in the organization is automatically an Authenticated User.
Therefore, the default behavior is for every GPO to apply to every
Authenticated User. Table 4.3 lists the default security permission settings
for a GPO.
Table 4.3 Default Security Permission Settings for a
GPO
Groups or Users
|
Security permission
|
Authenticated User
|
Read with Apply Group Policy ACE
|
Domain Administrators
Enterprise
Administrators
Creator Owner
Local System
|
Full Control without Apply Group Policy
ACE
|
Even though the Apply Group Policy ACE for
Administrators is unchecked, Administrators by default are still affected by
every GPO because they are members of Authenticated Users. To prevent a GPO
from applying to Administrators, or any other specific group, you need to
remove the Apply Group Policy ACE by clearing the Allow Group Policy for
Authenticated Users check box. You can then explicitly set Apply Group Policy
for the individual security groups that must receive the policy settings. By
following this procedure you can then use the Apply Group Policy ACE to apply
Group Policy only to those groups of users that are your intended target.
Note When Read is allowed and Apply Group Policy
is not allowed, the GPO will still be processed by the user, even though it is
not applied. Therefore, you might also want to consider removing the Read ACE
for performance reasons. In this case, the user can no longer see the GPO, so
it will not even be processed.
Alternatively, you can set a Deny ACE to prevent a GPO
from applying to a group of users. A Deny ACE setting for any group has
precedence over any Allow ACE that might apply to a given user or computer
because of their membership in another group. Use the Deny ACE with caution.
For more information about using security settings, see
"Delegating Control of Group Policy" in this chapter.
Note Non-administrators can log on to a domain
controller only if they have Log On Locally permission. This is part of the
Default Domain Controllers GPO, which is linked to the Domain Controllers OU
in Active Directory Users and Computers. The setting is found under Computer
Configuration/Windows Settings/Security Settings/Local Policies/User Rights
Assignment/Log on locally. Create a security group containing those users who
must be able to log on locally to the domain controller, and add them to the
list of groups shown on the Log On Locally form. Remember that computer policy
for the domain controller must refresh before the new permissions take effect.
