Microsoft KB Archive/322176

= HOW TO: Administer GPO Properties in Windows 2000 =

Article ID: 322176

Article Last Modified on 10/30/2006

-

APPLIES TO


 * Microsoft Windows 2000 Server
 * Microsoft Windows 2000 Advanced Server

-



This article was previously published under Q322176



IN THIS TASK
SUMMARY How to Start Group Policy Object Editor
 * To Edit a Group Policy Setting on the Local Computer
 * To Edit a Group Policy Setting on Another Computer
 * To Edit a Group Policy Setting on a Site
 * To Edit a Group Policy Setting on a Domain
 * To Edit a Group Policy Setting on an Organizational Unit

How to Filter the Scope of Group Policy According to Security Group Membership How to Find the Sites, Domains, and Organizational Units to Which a GPO Is Linked How to Turn Off the User Configuration Settings in a GPO How to Turn Off the Computer Configuration Settings in a GPO REFERENCES



SUMMARY
This article describes how to access and administer Group Policy object (GPO) properties in a Windows 2000-based environment. To perform the procedures that are described in this article, you must be a member of the Administrators group on a computer that is running Windows 2000 Advanced Server.

back to the top

How to Start Group Policy Object Editor
You can start Group Policy Object Editor in several ways, depending on the action that you want to perform. The following sections describe how to start Group Policy Object Editor in a variety of scenarios.

To Edit a Group Policy Setting on the Local Computer
To start Group Policy Object Editor to edit the local GPO, click Start, click Run, type gpedit.msc, and then click OK.

back to the top

To Edit a Group Policy Setting on Another Computer
Open the local GPO that is stored on the Windows 2000-based network computer, and then locate the network computer. You must be an administrator of the network computer to complete this procedure.

back to the top

To Edit a Group Policy Setting on a Site

 * 1) Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Sites and Services.
 * 2) In the console tree, right-click the site for which you want to configure a Group Policy setting, click Properties, and then click the Group Policy tab.
 * 3) Click an existing GPO in the Group Policy object links list, click Edit, and then link a GPO to the intended site.

back to the top

To Edit a Group Policy Setting on a Domain

 * 1) Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Users and Computers.
 * 2) In the console tree, right-click the domain or organizational unit for which you want to configure a Group Policy setting, click Properties, and then click the Group Policy tab.
 * 3) Click Edit to open the GPO that you want to edit, and then link a GPO to the intended domain.

back to the top

To Edit a Group Policy Setting on an Organizational Unit

 * 1) Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Users and Computers.
 * 2) In the console tree, right-click the domain or organizational unit for which you want to configure a Group Policy setting, click Properties, and then click the Group Policy tab.
 * 3) Click Edit to open the GPO that you want to edit, and then link a GPO to the intended organizational unit.

You can also link a GPO to an organizational unit that is higher in the Active Directory hierarchy so that the organizational unit can inherit Group Policy settings.

back to the top

How to Filter the Scope of Group Policy According to Security Group Membership
 Open the GPO whose scope you want to filter. Right-click the root node of the console to display the Group Policy icon that has the following label:

[ ] Policy

 Click Properties, click the Security tab, and then click the security group for which you want to filter this GPO.

To change the list of security groups for which you want to filter this GPO, click either Add or Remove to add or remove security groups. Set the permissions as they are described in the following table, and then click OK.

NOTE: GPOs are applied only to sites, domains, and organizational units. Group Policy settings affect only the users and the computers that they contain. Specifically, GPOs are not applied to security groups.

The location of a security group in Active Directory does not affect filtering through that security group as it is described in this procedure.

If a user or a computer is not contained in a site, a domain, or an organizational unit that is subject to a GPO either directly through a link, or indirectly through inheritance, you cannot set any combination of permissions on any security group to make those Group Policy settings affect that user or computer.

Filtering at the GPO level, as it is described in this procedure, causes the GPO to be processed or not processed as a whole. The Software Installation extension and the Folder Redirection extension use security groups to refine control beyond the GPO level. Except for Folder Redirection and Software Installation, security groups are not used to filter individual settings or subsets of a GPO. For control over individual settings, edit or create a GPO instead.

back to the top

How to Find the Sites, Domains, and Organizational Units to Which a GPO Is Linked

 * 1) Start Group Policy Object Editor with the GPO that you want to find at the root node of the console.
 * 2) Right-click the root node of the console, and then click Properties.
 * 3) Click the Links tab, and then click Find Now.

The sites, domains, and organizational units to which the GPO is linked are listed in the Sites, Domains or Organizational Units found box.NOTE: If the GPO is linked to more than one domain, you can limit your search for organizational units to one domain at a time by using the list in the Domain box.

back to the top

How to Turn Off the User Configuration Settings in a GPO
 Open the GPO that you want to edit. Right-click the console root, which appears as the following line:

[ ] Policy

</li> Click Properties, make sure that Disable User Configuration settings is selected, and then click OK.NOTE: The User Configuration settings in this GPO no longer affect any site, domain, or organizational unit to which this GPO is linked.</li></ol>

back to the top

How to Turn Off the Computer Configuration Settings in a GPO
 Open the GPO that you want to edit.</li> Right-click the console root, which appears as the following line:

[ ] Policy

</li> Click Properties.</li> Make sure Disable Computer Configuration settings is selected, and then click OK.NOTE: After you turn off the Computer Configuration settings in a GPO, they no longer affect any site, domain, or organizational unit to which this GPO is linked.</li></ol>

back to the top

<div class="references_section">