Mastering Windows Group Policy

How to block a GPO from a particular Active Directory group

So far, we have learned that the Security Filtering section is all about granting access to GPOs, but what if you want to flip things around? What if you have a GPO that is linked to a particular location, and you want everyone in that location to receive the GPO settings, except for just a handful of people? The Security Filtering section does not have any accommodation for such a request (to deny specific users, computers, or groups), but there is a way to do it. We will make use of the advanced Delegation properties that we viewed in the previous section of this chapter.

The newly created GPO for Lock down Control Panel is a good example. This policy is linked at the domain level ...