Group Policy / Wsus ...

Hey Guys,

All my machines are connected to my sus servia via a domain policy.

My boss seems to think that he doesnt fall under this and wants to edit everything locally on his laptop.

I edited his GP settings on his laptop.

Question: Will this override the domain policy?

Will have have to create another OU in AD and move him into there with another policy?

Whats the best practise here? First time actually playing with this so help will be appreaciated. (Ms M :)

Thanks

Quote:

---

Question: Will this override the domain policy?

---

Nope. The other way around. Local GP will be processed first. Then Domain Policy will overwrite those settings.

Quote:

---

Will have have to create another OU in AD and move him into there with another policy?

---

Hmm. I would create another OU & block GP inheritance on that OU.

Quote:

---

Hmm. I would create another OU & block GP inheritance on that OU.

---

This is what I would do as well. More specifically move the computer to the OU, as opposed to the user, as WSUS policies are applied to the computer settings.

Depending on what other policy settings you have, you may want to link certain GPOs specifically to the new OU. I would double check to see what settings are applied to that computer with Group Policy Results once you have it set up, just to make sure all of the right policies are applied.