GPO Computer Configuration applied to group of users

Question

I'm currently struggling with the following issue: in our organisation we want to prevent most users to access OneDrive. I found the following GPO setting in Computer Configuration to establish this:

Administrative Templates/Windows Components/OneDrive/Prevent the usage of OneDrive for file storage

However management should be allowed to use OneDrive so I created a Global Security Group containing all the management users, 'GRP_ALLOW_ONEDRIVE'.

Now we have 2 OU's: one containing the user & one containing the computers. So I link this GPO to the COMPUTERS OU & add a deny in the Security Settings for that specific group of users...

But this doesn't seem to work, which I should've guessed in the first place because it's Computer Configuration...

So basically my question comes down to this:

How can I successfully create a GPO in the COMPUTERS OU to disable OneDrive except for the users in the exception group? It should not matter what computer the management logs on to, they should always have access to OneDrive. All others users should not be able to start OneDrive, no matter what computer they log on to.

Thanks!

Solution

Unfortunately, this can't be done. You can't apply or filter Computer Configuration settings to users.

What you could do would be to use Software Restriction Policies under User Configuration settings to block the OneDrive executable. You could then filter this GPO for specific Users or Groups.

Comments

[Mer]

It doesn't work because it's a Computer GPO setting and your group contains only users.

[jojojoj]

If your new to GPO's, I thought it was worth mentioning that sometimes the same setting appears under both the User config and the Computer config sections. For those kinds of settings you could deploy them to either target type. But I just checked a Win10 and see that this setting is only avail within the computer section. A limiting design choice on Microsoft's part...

[Kev]

I tried this solution and it seems to work. Deleted the Computer Configuration setting & added a User Software Restriction Policy for %LOCALAPPDATA%\Microsoft\OneDrive\OneDrive.exe. Now the executable is blocked for all users except for the management who reside in the security group with a deny for this GPO. I also updated a registry key to hide the OneDrive from the navigation pane because it added itself even though the exe is blocked. HKCU\SOFTWARE\Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2E‌​D1FE6}\System.IsPinn‌​edToNameSpaceTree = 0