Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us $3,400 per month for bandwidth bills alone, and since we don't believe in shoving popup ads to our registered users, we try to make the money back through forum registrations.
«31 »
  • Locked thread
Judge Schnoopy
Nov 2, 2005

dont even TRY it, pal

According to logic statements though, T or F is true since one of the criteria is met. Similarly, ~T or ~F is still true. True in this case is getting the printer mapped so the or statements shouldn't work. User A gets the printer for meeting "or the user isn't user B" requirement.

Unless GPO is hosed up and processes this as ~(true or false), getting false.

It should require an and statement since ~true and ~false is false. I've been struggling trying to wrap my head around this all day.

But this thread has pointed me in the right direction. User A and user B are in a new security group, printer is applied to users not in the group. No need for two statements at all.

Adbot
ADBOT LOVES YOU

Hiyoshi
Jun 27, 2003

The jig is up!

As said before, you want not User A or User B, or ~(User A OR User B). Not User A and User B, or ~(User A AND User B), will always evaluate to true because there will never exist an individual user that is both User A and User B. Think of it with a few tests:

~(User A OR User B)
1. User A: ~(1 OR 0) = ~1 = 0 = False (i.e., don't apply policy)
2. User B: ~(0 OR 1) = ~1 = 0 = False (i.e., don't apply policy)
3. User C: ~(0 OR 0) = ~0 = 1 = True (i.e., apply policy)

~(User A AND User B)
1. User A: ~(1 AND 0) = ~0 = 1 = True (i.e., apply policy)
2. User B: ~(0 AND 1) = ~0 = 1 = True (i.e., apply policy)
3. User C: ~(0 AND 0) = ~0 = 1 = True (i.e., apply policy)

You may be meaning to say not User A and not User B, or (~User A AND ~User B), which is logically equivalent to ~(User A OR User B):

(~User A AND ~User B)
1. User A: (~1 AND ~0) = (0 AND 1) = 0 = False (i.e., don't apply policy)
2. User B: (~0 AND ~1) = (1 AND 0) = 0 = False (i.e., don't apply policy)
3. User C: (~0 AND ~0) = (1 AND 1) = 1 = True (i.e., apply policy)

Judge Schnoopy
Nov 2, 2005

dont even TRY it, pal

Ok cool, thanks. I've got the understanding of the logic down, it was just a question of how GPO processes two statements. If they were processed individually (~a and ~b) I need a different solution than if they are processed together as ~(a or b).

The way it's worded on the screen implies they are processed individually because there is a not in front of both cases. It doesn't make sense that GPO would take two not statements, group them as positives, then add the negative to the group as the second example shows.

CuddleChunks
Sep 18, 2004



This is a really useful thread. Thanks for all the helpful info, folks!

peak debt
Mar 10, 2001
b& :(

Nap Ghost

Wizard of the Deep posted:

You won't see any serious slowdowns (under normal conditions) for adding another group or two

This is how we ended up with 6 times as many groups as users

Adbot
ADBOT LOVES YOU

Wizard of the Deep
Sep 25, 2005


peak debt posted:

This is how we ended up with 6 times as many groups as users

I think at a 6:1 group:user ratio, we've stopped talking about "normal conditions".

  • Locked thread
«31 »