Active Directory Cookbook

9.10. Disabling the User or Computer Settings in a GPO

Problem

You want to disable either the user or computer settings of a GPO.

Solution

Using a graphical user interface

1. Open the GPMC snap-in.

2. In the left pane, expand the Forest container, expand the Domains container, browse to the domain of the target GPO, and expand the Group Policy Objects container.

3. Right-click on the target GPO and select GPO Status

4. You can either select User Configuration Settings Disabled to disable the user settings or Computer Configuration Settings Disabled to disable the computer settings.

Using VBScript

' This code can enable or disable the user or computer settings of a GPO.
' ------ SCRIPT CONFIGURATION ------
strGPO      = "<GPOName>"        ' e.g. Sales GPO
strDomain   = "<DomainDNSName>" ' e.g. rallencorp.com boolUserEnable = False boolCompEnable = True ' ------ END CONFIGURATION --------- set objGPM = CreateObject("GPMgmt.GPM") set objGPMConstants = objGPM.GetConstants( ) ' Initialize the Domain object set objGPMDomain = objGPM.GetDomain(strDomain, "", objGPMConstants.UseAnyDC) ' Find the specified GPO set objGPMSearchCriteria = objGPM.CreateSearchCriteria objGPMSearchCriteria.Add objGPMConstants.SearchPropertyGPODisplayName, _ objGPMConstants.SearchOpEquals, cstr(strGPO) set objGPOList = objGPMDomain.SearchGPOs(objGPMSearchCriteria) if objGPOList.Count = 0 then WScript.Echo "Did not find GPO: " & strGPO WScript.Echo "Exiting." WScript.Quit elseif objGPOList.Count > 1 then WScript.Echo "Found more than one matching ...