Exclude Sub-OU from a portion of a Parent Policy...

[andozane]

Hi there...

I have a Staff OU with a comprehensive GPO that sets all kinds of enterprise settings for all staff (proxy, bookmarks for IE, permissions, etc...)
One of the things we set in there is blocking the user's ability to use Windows Updates.

We have a sub OU to the all staff that contains "Priveleged Accounts". I would like this OU to still receive all the normal settings, but I want to allow these accounts to use Windows Updates.

So how do I go about doing this? If I create a copy of my parent GPO, assign it to the Priv Accounts sub-OU, and only change the windows update portion, would that work? Or would all I need to do is create a new GPO to the Priv accounts sub-OU and just have the only setting to allow windows updates? Would inheritance keep all the normal settings and then just switch back on the updates?

Thanks for any help!

[jeff_longley]

Create a new policy to flip Disable the Disable access to windows updates and apply it to your "Priveleged Accounts" OU.