Suppose a person ( CEO/MANAGER) wanted special privileges to their assets/objects.These are the special privileges he wanted.: a) The manager wanted complete control over assets/objects. b) The manager wanted to be exempt from Group policy set forth for other users . That is he wanted to be exempt from any changes made to the other people effect him. In fact he wanted complete control over his Work Station. How do you suppose i could do that? Thanks Bharat

You said that the manager wants to have a full control on his computer. For that, start by giving his domain account membership of local admin group of his computer. As I have understood, you want to exclude your manager from the appliance of group policies. To perform that, run gpmc.msc and select your group policy then click on Delegation. Once done, make sure that your manager domain account has Deny permission for applicance of the group policy. This posting is provided "AS IS" with no warranties or guarantees , and confers no rights. Microsoft Student Partner Microsoft Certified Professional Microsoft Certified Systems Administrator: Security Microsoft Certified Systems Engineer: Security Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration

Dear X, I have a doubt. Is a a good idea to create a seperate OU within the domain for this special user, so that he can take care of his own. Your idea is simple. But how does this OU solution work? Thanks Bharat

Yes, it will work also but you should make sure that there is no group policy linked to it. To check which group policies are applied on this user, use rsop or gpresult. This posting is provided "AS IS" with no warranties or guarantees , and confers no rights. Microsoft Student Partner Microsoft Certified Professional Microsoft Certified Systems Administrator: Security Microsoft Certified Systems Engineer: Security Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration

Dear X, Let me get this straight...... If the user is in the same domain, then Group Policies can affect him . As far as i know we have one domain and one OU, So if i create a seperate OU, then group policies effective in One OU are same in another OU...... Thanks Bharat

If you create a separate OU then only domain level group policies will be applied on it. If you want that domain level group policies will not be applied on your user, you can proceed like mentioned in the screen capture I provided. This posting is provided "AS IS" with no warranties or guarantees , and confers no rights. Microsoft Student Partner Microsoft Certified Professional Microsoft Certified Systems Administrator: Security Microsoft Certified Systems Engineer: Security Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration

Dear X, Gotcha.......Now So there is domain level group policy and OU level group policiy. ..... i get it now.... Thanks Bharat