Hello, After you create a policy, (Example, removing away "My Computer" or the "Network Neighborhood" from the desktop)how do you assign the policy to a specific "user" or "Group" and not just the whole domain? Can it be done? Thanks. Mitch .

Create an OU(organizational unit) put the users you want affected in it. go to group policy add a new one in the OU properties set the limits you want to affect the users in the OU.This will cause just the users in the OU to be affected.DO NOT add the admin as a user there or he is affected as well. This of course can be fixed if he is.

W2K Group Policies are applied to Sites, Domains or OUs in a W2K Domain environment. They are not applied to Groups or Users. As shovel said above, they will be applied to the users who are contained within the container (site, domain or OU)to which the GPO is applied. Any user or group held within this container who has the Read and Apply Group Policy security permissions will be affected. So, all policies created at the Domain level will in essence be applied to all user accounts in the Domain if the default Everyone Group is left listed in the DACL of the Group Policy. The Everyone Group will be listed by default with Read and Apply Group Policy permissions. If GPOs exist in multiple containers they will be applied in the order of Site then Domain then OU. Please note that Local Policies are actually applied prior to GPOs and that any policy conflicts are decided by the last policy read. There are ways to block this flow and ways to exclude Groups and/or Users from Group Policy effects.