Hi,
I'm trying to impose tighter restrictions in our domain regarding who is allowed to logon to which computers.
In general, that can be achieved with a group policy with the setting 'allow logon locally' specified for the user groups that use that computer and a security filtering for the computers affected.
Is it possible for a computer to inherit values for the same setting from various group policies? For example, GPO1 defines that user class A is allowed to logon. GPO2 defines that user class B is allowed to logon. Some computers might be used by class A
and B, so both GPOs should be applied. As far as I know, GPOs are simply applied in the specified order, resulting in overwrite. Therefore, only user class A or B is allowed to logon, depending on the link order. So I need to create a third GPO that defines
that users A and B are allowed to login.
Creating so many GPOs seems messy, doesn't scale well when new computers are introduced, etc. Which is why I'm asking if there's a better way to do this.
Any help is appreciated, I couldn't find valuable information on the topic as of yet.