Member Avatar for amazingsunday

I'm Newbie here and don't even know where do i post my problem . There's so many threads. So just let me post here.

I want to restrict that some users don't change stuff in internet options. I use AD for my Client/sever network . I know i can restrict in GPO . But where do i do that in AD ? Please Help.

  • 2 Contributors
  • 2 Replies
  • 124 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by amazingsunday

Dani AI

Generated

Good call following — GPMC is the right tool for creating and managing Group Policy objects. For this specific goal (preventing users from changing Internet Options) the important points are: target user settings, place the GPO where the affected user accounts live, and verify scope and filtering.

Typical workflow:

  • Open GPMC on a domain controller or an admin workstation with RSAT, create a new GPO and link it to the OU that contains the user accounts (not the computers) you want to control.
  • Edit the GPO and look under User Configuration -> Policies -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel. Disable or enable the subsettings for the tabs you want to block (Connections, Security, Privacy, Programs, Advanced) and use the proxy/home-page specific policies if you only need to lock those.
  • If the restriction must apply to specific users only, create an AD security group, add the users, then use Security Filtering on the GPO (remove Authenticated Users and add your group). Keep at least Read and Apply Group Policy permissions.

Important operational notes and troubleshooting:

  • Internet Options are user settings; if you need them enforced regardless of who logs on to a machine (kiosk scenario), enable loopback processing: Computer Configuration -> Administrative Templates -> System -> Group Policy -> Configure user Group Policy loopback processing mode (set to Replace).
  • After changing GPOs, force an update on the client with gpupdate /force and verify application with gpresult /r or RSOP.msc. Common reasons a GPO seems not to apply are wrong OU placement, security filtering errors, higher-precedence GPOs, missing ADMX templates for the client OS/IE version, or replication delays.
  • Note that Internet Explorer has been deprecated in modern Windows; on recent systems use the appropriate Microsoft Edge policy templates or MDM controls instead.

Recommended Answers

All 2 Replies

Member Avatar for DimaYasny

in Active Directory Users and Computers, right click the domain name

but the better way is to download and install GPMC

Member Avatar for amazingsunday

Great . Problem sloved . GPMC is very easy to use and effective.
Thanks everyone.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.