Hello there, I would like to disable accessing windows update in our domain where we have around 300 servers (2003, 2008 and 2008R2). What I aim is, only a group for example domain admins should have access to windows update features just like giving restart right to a group. I have found "Remove Links and Access to Windows Update" policy but it is working for everyone. Regards. MCTS, 2008R2 Server Virtualization http://erkanaksoy.net

To exclude a global security group from the appliance of a group policy, proceed like that: Select your group policy Click on Advanced Add your group and select Deny for Apply group policy Like that, the group policy will be applied on all your users in the domain expect the excluded global security group. (Here I supposed that your group policy is linked at the domain level). Have a look to this MSDN article. This posting is provided "AS IS" with no warranties or guarantees , and confers no rights. Microsoft Student Partner Microsoft Certified Professional Microsoft Certified Systems Administrator: Security Microsoft Certified Systems Engineer: Security Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration