Limit usage by user OU

If defined, the user must be member of at least one of these groups. Multiple groups or OUs must be split by a vertical pipe, such as "Domain Admins|Customer Relations". This is because comma may naturally appear in groups or OU names and always appears in full distinguished names for OUs. OUs can be specified as full distinguished name or simply the OU name itself. Note that if a OU name is not unique, the check will happen on either. In a list, the user/computer must be member of one (not all) to allow administrator elevation. Note that local users (except Administrator) can not elevate, when domain groups or OUs are in place. Users can always request a PIN code for elevation, in case of an exception.

Supported on: Windows 10


Registry PathSOFTWARE\FastTrack Software\Admin By Request\Policies
Value NameUserOUs
Value TypeREG_SZ
Default Value