Active Directory - How to disable GPO for a specific admin group (not standard users)

Question

Hello,

After multiple searches, I unfortunately cannot find a solution to a problem with GPO's (Windows 2019 Server).

I created a GPO which activates the firewall (Computer Configuration), computers present in an OU (Dekstops). This one works perfectly to users. But I want to deactivate it for a specific admin group. To do this I applied in the delegation a "Deny" in "Apply group policy" (admins group).

Also, this group is a member of local Administrators (with another GPO, I used "Restricted Groups" to do that)

After performing several tests with a member of this admin group and executed some "gpupdate /force", the GPO still applied. Do you have a solution to bypass this GPO for my admin group ?

I also tried to apply the loopback on this GPO but still the same result ... Thank you for your help and advices.

Answer 1

Hi @Maverick128 ,

have you tried the loopback processing for the GPO?
https://learn.microsoft.com/en-us/troubleshoot/windows-server/group-policy/loopback-processing-of-group-policy

----------

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards
Andreas Baumgarten

Answer 2

Hello @Andreas Baumgarten ,

Thanks for the reply. Yes, I tried the "Group Policy loopback" with the both modes : Merge / Replace. Unfortunately, same result...

Below the configuration :

Answer 3

Anyone have a solution or an idea to resolve this problem ?

Is it possible to bypass the "computer configuration" policies for a specific group ?

Many thanks.

Best,