How to exclude a specific user from group policy object (GPO)

In this video, I'll show you how to easily exclude a specific user or group of users from a group policy object (GPO).

When you apply a GPO to an OU it applies to all of the objects in that OU (users or computers). There are times when you need to exclude specific users from a GPO such as your admin users.

The best method to exclude users from a GPO is by creating a group and using the GPO delegation settings to deny access to the GPO.

Complete Group Policy Guide:

GPResult command:

More Active Directory Tutorials:

[ivvi]

For some reason I always kept unticking the "read", as some articles keep suggesting that. This worked, thank you.
As an FYI, I had to first disable the linked GPO to the OU to get the affected devices and users to be removed from the GPO after which it worked as intended. The GPO kept sticking around with just the changes mentioned.

[asnyc]

My question is can I deny one specific portion of the GPO from applying but keep the rest for one user/computer. There is one security option I want disabled but the rest to apply.

[sumeetkumar]

Hello Sir, can we do the same if we want to exclude a security group (containing service accounts) to be excluded from the default domain policy GPO? Kindly confirm if this is supported action and do attach any reference article from Microsoft. Thank you a lot!!!!

[aolish]

I have a strange situation that I was hoping anyone can resolve. This method works great the first time around, but when I add another user to the GPO Exclusions group that is now in the Delgations tab, it doesn't apply to that user even with a "gpupdate /force" already applied to it. Is there something I'm missing? Do I have to create another GPO Exclusions group for another user or can I use the same GPO exclusion that was created here and just adding another user to that group? I did that but it doesn't work but ironically DOES work for the first user that I had created. Any help is greatly appreciated. Thank you.