Would you like to learn how to apply a group policy to a specific user account? In this tutorial, we will show you how to configure the GPO permissions to apply its configurations to a specific user or group.

• Windows 2012 R2
• Windows 2016
• Windows 2019
• Windows 10
• Windows 7

Equipment list

Here you can find the list of equipment used to create this tutorial.

This link will also show the software list used to create this tutorial.

Tutorial GPO - Apply to a specific user

On the domain controller, open the group policy management tool.

Windows 2012 - Group Policy Management

Create a new group policy.

Windows 2012 - Group Policy Objects

Enter a name for the new group policy.

Windows - Add GPO

In our example, the new GPO was named: MY-GPO.

On the Group Policy Management screen, select your GPO and access the Delegation tab.

GPO - Delegation

On the bottom of the screen, click on the Advanced button.

GPO - Delegation Advanced

Select the Authenticated users group and uncheck the permission to apply the group policy.

GPO - Specific user

Click on the Add button and enter a user account.

GPO - Configure user account

Select the user account and give permission to apply the group policy.

GPO - Apply to individual user

Optionally, you may apply the GPO to a specific group of users.

GPO - Apply to group

In our example, the account USER01 was given permission to apply the GPO named MY-GPO.

Tutorial GPO - Applying the group policy

On the Group policy management screen, you need to right-click the Organizational Unit desired and select the option to link an existent GPO.

Windows-2012-Applocker application

In our example, we are going to link the group policy named MY-GPO to the root of the domain.

GPO- tutorial linking

After applying the GPO you need to wait for 10 or 20 minutes.

During this time the GPO will be replicated to other domain controllers.

Reboot a remote computer and verify if the configuration was applied only on the selected user account.

In our example, only the account USER01 will apply the configurations from the GPO named MY-GPO.