How do I create separate uReset policies for different user groups?
This article will walk you through configuring multiple policies with in the Specops Authentication platform. It is important to note that this will not work if your policy mode is set to cloud mode. It will need to be set to group policy or both. https://specopssoft.com/support/en/ureset-8/authentication-web.htm#ureset.
Go to Group Policy Management console.
If this is your initial policy
Create your policy you will use for this policy and tag the policy where you would like it applied within the Active Directory structure. This will generally be Authenticated users:
If this is an additional policy
Create your policy you will use for this policy and tag the policy where you would like it applied within the Active Directory structure. The security filtering here will be a security group. No additional configuration for this policy is needed.
Go to Group Policy Management Console and go to the scope tab on the policy you wish to modify and highlight authenticated users and select remove:
The following messages will pop up, which is normal as the next steps will correct the issue, so click Ok on both of these messages:
Then add the desired security group:
Then switch to the Delegation Tab and Add Switch to the delegation tab and add authenticated users with read access:
After this, the policy with the security group will need to be adjusted to a higher precedence, since we would want the policy with the security group to apply first and then have the policy with Authenticated Users to apply after.
On the Gatekeeper
Tag the GPOs on the uReset tab:
From here you should be able to log into the Admin console from the Gatekeeper Tab and confirm both policies exist:
You are now able to see and edit both policies there and if you are curious to see if a single user applies to which policy, you can look them up in the service desk.