TS Group Policy

[adamf]

I'm trying to apply some group policy settings to our terminal servers to restrict certain elements when a member of staff is logging to it. I have created the GPO, added the staff security group to the Security Filtering section of GPMC so that the policies don't apply to myself and other administrators, GP Modelling reports that the policies are being applied but when I log in none of them seem to have taken effect.

 

When I remove the staff security group and revert to Authenticated Users the policies apply correctly but they effect myself and other admins (as you would expect)

 

What am I doing wrong

[FN-GM]

Does the user group have the security rights to apply the policies. Also have you checked you have added the user to the group.

 

Why are you not doing the group policy based on OU?

[adamf]

Does the user group have the security rights to apply the policies. Also have you checked you have added the user to the group.

 

The security group has "Read (from security filtering)" permissions on the GPO and yes the user is part of the group! Also it's a universal group because the user exists in a different domain in the forest - should that make a difference?

 

 

Why are you not doing the group policy based on OU?

 

The terminal servers are in their own OU and loopback processing (in replace mode) is on so that users don't get the normal user settings as if they were logging on to a normal machine.

Edited May 4, 2008 by adamf

[FN-GM]

Ah right ok, try without loopback and see what happens then.

 

Do they have the "apply group policy" permission?

 

Z

[adamf]

I've got to have loopback on otherwise they will get their standard user settings they would get when they log on to a normal machine. I can't have staff having access to the server that would enable them to browse the local drives etc......

[FN-GM]

Just try it without and see if they get the standard settings. Loop back can cause problems with group policies applying.

[meastaugh1]

Try applying the policy to a domain local or global group to see if that helps.