User or computer GPO

[meanoldman]

I like the idea of applying these Paks at the user level as it allows me to log onto associates computers as a different user who is not impacted by the Paks and tinker when need be. But I am wondering 2 things:

1) are there Paks that you would be more inclined to apply at a computer level?

2) If I log on as a user to whom a Pak does not apply and, for example, Adobe can now automatically check for updates (oops) will the nag that an update is ready appear when a user who IS affected by the Pak logs back on?

To item 2, so far it appears that yes once the update is download it will produce the nag no matter who logs on. I am going to check this a bit more, but if this is indeed the case is there a simple way suppress the nag in case this happens again?

[jeremym]

I *TEND* to suggest that "Where the user goes, the user's settings should go too."

So I lean toward the USER side for MOST paks. 80% of the action happens in KHEY Current User anyway.

On the other hand, some paks work BETTER in computer-mode (thus affecting all users.)

Those are:

() Java.
() Firefox.
() Thunderbird.

Those use special files to perform the UI lockdown. And when they do it, they affect all users on the computer. So, in those cases, the UI lockdown MUST (and can only be) on the COMPUTER side.

To summarize: You cannot go *WRONG*..

If you want to say "All users on these COMPUTERS gets the settings.." That's A-OK .. Use COMPUTER side.
If you want to say "Whenever a user roams, he keeps his settings with him." That's A-OK.. Use USER side.

Also, PolicyPak de-necessitates the need for LOOPBACK GP processing mode.

With our ability to perform "All users on these COMPUTERS gets the settings.." we can achieve what loopback can -- without all those extra GPOs / settings that you DONT want to get involved.

Hope that helps.

[meanoldman]

Great info, thanks!

[Sponsored content]