I'm almost positive I this isn't something that can be done, but I'm not 100% here.
What I'm doing is attempting to lock down various bits of external media on computers on the network, the lowest level being nothing.
However my understanding is that if a user is in multiple groups (e.g. a "CD Access " and a "No Access" group) the stricter GPO will apply.
Not that it's not impossible to manage, but is there any way to configure this so that I can give access to those that need it specifically, rather than creating one big group for deny, and smaller groups for allow.
Thanks