Creating multiple local GPOs

Computers that are members of an AD DS domain benefit from a great deal of flexibility

when it comes to Group Policy configuration. Standalone (non–AD DS) systems can achieve

some of that flexibility as long as they are running at least Windows Vista or Windows Server

2008 R2. These operating systems enable administrators to create multiple local GPOs that

provide different settings for users, based on their identities.

Windows systems supporting multiple local GPOs have three layers of Group Policy

support, as follows:

■■ Local Group Policy Identical to the single local GPO supported by older operating

system versions, the Local Group Policy layer consists of both computer settings and

user settings and applies to all system users, administrative or not. This is the only local

GPO that includes computer settings, so to apply Computer Configuration policies, you

must use this GPO.

■■ Administrators and Nonadministrators Group Policy This layer consists of two

GPOs: one that applies to members of the local Administrators group and one that

applies to all users who are not members of the local Administrators group. Unlike the

Local Group Policy GPO, this layer does not include computer settings.

■■ User-specific Group Policy This layer consists of GPOs that apply to specific local

user accounts created on the computer. These GPOs can apply to individual users only,

not to local groups. These GPOs also do not have computer configuration settings.

Windows applies the local GPOs in the order listed here. The Local Group Policy settings

are applied first, then either the Administrators GPO or the Non-Administrators GPO, and,

finally, any user-specific GPOs. As with nonlocal GPOs, the settings processed later can

overwrite

any earlier settings with which they conflict.

In the case of a system that is also a member of a domain, the three layers of local GPO

processing come first, followed by the standard order of nonlocal Group Policy application.

To create local GPOs, you use the Group Policy Object Editor, which is an MMC snap-in

provided on all Windows computers specifically for the management of local GPOs, as in the

following procedure.

1. Open the Run dialog box and, in the Open text box, type mmc and click OK. An empty

MMC console opens.

2. Click File, Add/Remove Snap-In to open the Add Or Remove Snap-Ins dialog box.

3. From the Available Snap-Ins list, select Group Policy Object Editor and click Add. The

Select Group Policy Object page opens.

4. To create the local Group Policy GPO, click Finish. To create a secondary or tertiary

GPO, click Browse. The Browse For A Group Policy Object dialog box opens.

5. Click the Users tab, as shown in Figure 6-4.

FIGURE 6-4 The Users tab of the Browse For A Group Policy Object dialog box

NOTE: MULTIPLE LOCAL GPOS

Windows computers that do not support multiple local GPOs lack the Users tab in the

Browse For A Group Policy Object dialog box. This includes domain controllers and computers

running Windows versions prior to Windows Vista and Windows Server 2008 R2.

6. To create a secondary GPO, select either Administrators or Non-Administrators and

click OK. To create a tertiary GPO, select a user and click OK. The GPO appears on the

Select Group Policy Object page.

7. Click Finish. The snap-in appears in the Add Or Remove Snap-Ins dialog box.

8. Click OK. The snap-in appears in the MMC console.

9. Click File, Save As. A Save As combo box appears.

10. Type a name for the console to save it in the Administrative Tools program group.

11. Close the MMC console.

You can now open this console whenever you need to configure the settings in the GPO

you created.