Trilight Zone

[digital8]

I'm just getting into group policy and was wondering how to have the domain admin when you log into the local computer not have the group policy restrictions effect that account?





The easiest way is to modify the security on the GPO itself. Under the Security tab for the GPO select "Domain Admins" and check the "Deny" box for "Apply Group Policy".





Deny is a nasty thing to do in Microsoft as it can effect more than you may know of. All you have to do is deselect the "Apply Group Policy" setting in the Security of the group Policy.





Another way to do this is to put all of your domain admins into their own OU, and then block policies from applying to that OU.

If you want to stop Computer Policies from applying when a Domain Admin logs on - I don't think there is a way to do that. The policy is going to apply before the computer knows who is going to log on.