Creating Global Policies in Active Directory. Server 2003.

[Arch_Angel]

So I am hired by a local high school to work on their computer labs. I suggested Windows SteadyState to them and they loved the idea of it and now I have the task of installing it on their pc's.

Silly me only found out during installation, SteadyState doesn't work on domain users, only local accounts.
Domain users will need some global policies done to replicate what SteadyState can do.
Sooooo, I am trying to do just that, with google and youtube as my source of information. lol

Anyways, They have 3 labs. 1 is used for the upper school (4th/5th formers). The others for lower school.
I want to apply a user policy, to users (students) using computers in lab 2 and lab 3, so not ALL the computers.

What I TRIED to do, was create group with only those pc's in lab 2 and lab 3.
Then I created a user policy and added the group of computers, plus the student user to it.

But from what I have read is, you can't apply user policy to computers, only user accounts.

Any advice on how to go about doing what I want?
Using Windows Server 2003.

[kilaj1]

been a while since i played around with group policy but you can adjust computer specific policies via group policy editor on the domain, what exactly is the policy your trying to change? not too familiar with SteadyState though...will look it up

Update: assuming its these settings?
http://technet.microsoft.com/en-us/l...=ws.10%29.aspx

[Arch_Angel]

been a while since i played around with group policy but you can adjust computer specific policies via group policy editor on the domain, what exactly is the policy your trying to change? not too familiar with SteadyState though...will look it up

Update: assuming its these settings?
http://technet.microsoft.com/en-us/l...=ws.10%29.aspx

Man, that is pretty darn helpful.

Yeah, specifically I was adding the policy to disable access to the D drive. But that is just 1 of others I want to implement. Figured if I get this figured out, the others would come easier.

[kilaj1]

okay that's definitely group policy, can be a pain sometimes to implement in a domain but when it works its pretty good. But it still comes down to how you want them to apply...let me fire up my test environment later today and I can see if i can find the exact policies. but its definitely doable. May involve moving around some computer accounts in AD into a OU by itself to apply the group policies that way, or if your doing it for when the user logs in you can customize the group policy to apply to specific servers once the user logs in.

I had to do the latter once for an application we wanted to run only if the person belonged to a certain group and it would apply the CD key for the app for the specific server it was logging into (key was generated based on the hardware of the system)