How to Deny Access to a GPO using the Group Policy Management Console

Created: 2009-02-19
Modified: 2009-05-13


After installing the Group Policy Management Console (GPMC) MMC the way an Administrator prevents a GPO from applying to user’s changes.



Without the GPMC an Administrator can use the Group Policy Tab on the OU and selectively Deny GPO’s by adding users or groups to the Security Tab and selecting the Deny – Read and Deny – Apply Group Policy settings.



This method is no longer available after the GPMC is installed.



After the GPMC is installed the Administrator should use the following steps to Deny access to specific GPO’s so they are not applied to users.


1)      Open the GPMC

2)      Browse to the GPO you wish to configure security for

3)      Select the GPO

4)      Click the Delegation Tab

a.       Click the Advance Button

5)      The Security properties tab opens and you can now configure Deny permissions for specific groups.


More Information:

This process is only needed if want to Deny access to specific groups of users.  To configure the GPO to apply to a group of users simply use the Add button on the Delegation tab instead of the Advance button.

Article ID: 141, Created On: 9/18/2011, Modified: 9/18/2011