Member Avatar for cguan_77

hi guys, how to create a gpo for specific accounts on a domain environment? Thanks in advance. OS: Win2k8

  • 3 Contributors
  • 3 Replies
  • 136 Views
  • 1 Month Discussion Span
  • Latest Post Latest Post by mdm7923

Dani AI

Generated

As noted, targeting by OU or group is the right approach, and ’s reminder about linking is important. The behaviour described (policy set but Messenger still runs) is most often caused by scope/permission mismatches, the wrong policy section being targeted, the client running a different Messenger product, or policy simply not being applied yet. The checklist below focuses on verifiable diagnostics and the exact fixes that commonly get missed.

Run these checks on an affected workstation and inspect the results for the user account in question:

gpupdate /force
gpresult /r
gpresult /h C:\gpresult.html

In the gpresult output, confirm both that the target security group appears under the user’s group membership and that the GPO appears under “Applied Group Policy Objects.” If the GPO is missing, check the GPO’s Delegation tab: the security group needs both Read and Apply Group Policy permissions (removing Authenticated Users without adding explicit rights is a common error). Also confirm the GPO is linked to the container that actually holds the user (or computer) objects and that no Block Inheritance / higher-precedence GPO is negating it.

Verify scope: the Messenger settings being used live under User Configuration (Administrative Templates → Windows Components → Windows Messenger). If the intention is to block Messenger based on the computer the user logs into, enable User Group Policy loopback processing on the computer-side GPO (Computer Configuration → Policies → Administrative Templates → System → Group Policy → User Group Policy loopback processing mode) and choose Merge or Replace as needed.

Finally, confirm the product: legacy Windows Messenger (process msmsgs.exe) is different from Windows Live Messenger (process msnmsgr.exe). Administrative Templates for Windows Messenger will not control newer Live Messenger clients. If gpresult shows the GPO applied but the app still runs, check the Group Policy Operational event log for CSE errors and the actual process name to decide whether a different ADMX/ADM or a software removal package is required.

Recommended Answers

All 3 Replies

Member Avatar for pjdg

hi guys, how to create a gpo for specific accounts on a domain environment? Thanks in advance. OS: Win2k8

Greetings and Felicitations

You could put the specific accounts into a specific Organisational Unit (OU) and link/apply the GPO there. The GPO will affect everyone within those OUs, so you will have to ensure that anyone you do not wish to be affected by the GPO is excluded from this OU, or is filtered out on the GPO linked to the OU. Also, you will have to take into account things like Group Policy precedence, etc.

Or, if for some reason you cannot do that, put the specific accounts into a global security group, apply the GPO at domain level and then filter it so it will only apply to the security group you have defined.

Hope this helps ... keep smiling

Member Avatar for cguan_77

hi pjdg,i had created a global security group then apply these settings:
Do not allow Windows Messenger to be run – enabled
Do not automatically start Windows Messenger initially – enabled

but the messenger still runs on the user domain computer? any ideas or what i'm doing wrong? Thanks :)

Member Avatar for mdm7923

Did you link the GPO to the domain you are putting this policy in effect for? It will not work unless the GPO is linked to the domain.

You can do this in the group policy editor in w2k8 by going to the root of your domain, and right clicking on it. it should give you an option to link the GPO. select the GPO that you created. try logging in again, the policy should be in effect

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.