in a bit of a muddle with policies

[sacrej]

Hi all,

 

I'm trying to apply a policy to all curriculum workstations for all staff users

in the past students were locked down with a student lockdown policy linked to students container, but I can't necessarily do this with staff as I dont want it to apply to staff laptops. (basically want to keep curric machines clean and tidy)

 

I've tried all sorts of things and cant seem to find the right combination

 

I have a test staff account and I can get my policy to work if I apply it to the staff container and then add this one user to security filtering, but this affects ALL computers....I just want curric machines...

 

help!

[Stuart_C]

Could you put the Curric machines into an OU? For example I have a "School Computers" OU then subcontainers for each department and a seperate "Other" OU?

[sacrej]

We already do, Have a Curric machines OU with subfolders for each classroom and a seperate OU for staff laptops, but if I assign the policy to the curriculum machines container and run gpresult /v it says the policy is disabled due to security filtering, even though the user is assigned to the policy aswell.

 

*headaches*

[teejay]

If you want to apply it to the computer OU, you either have to set the policy in the Computer Configuration rather than User COnfiguration of the GPO, or use loopback processing, but if you enable loopback it will affect how other policies are applied.

[sacrej]

hmmm computer configuration isnt an option really as its stuff to do with start menu's, folder redirection etc that arent available under computer configuration.

how does loopback processing work?

[teejay]

See Loopback processing of Group Policy

[Firefox]

Create a security group and add the machines you want to target as members

Create a security and add the users you want to target as members

Under the policy remove, authenticated users from security Filtering, and add the 2 newly created groups

 

This should work if I understand the issue correctly, this is very much how we set our policies

[sacrej]

Doesnt seem to work - followed that exactly as you said - have a curric machines security group and an all staff security group added them both to security filtering and removed authenticated users and then linked the GPO to the Class rooms OU in AD

If I login as a member of staff I get nothing (no changes)

tried running group policy modeling and that doesnt seem to apply the changes either.

*grinds face against wall*

[Firefox]

I assume once you applied the GPO you ran a gpupdate /force? did this work?

If you run a Gpresult /R does it tell you if the policy is applying? if not does it give a reason as to why?

[sacrej]

gpupdate /force then gpresult /v

it comes up under applied group policy objects, but not under the user configuration part - which is where all my changes are..hmmff...couldnt seem to get the loopback thing to work either.

 

time to go home!

[srochford]

If you are applying changes which are "user" changes but you want them applied to "machines" then you need to setup loopback (and it is a pig ...) *and* do the security settings *and* apply the GPO at the right level.

 

You could also look at WMI filters - this makes it easier because you can then say "apply the policy to these users if the machine is a desktop" (but not that the "desktop" detection logic only works well for Vista/Windows 7; there's no good WMI filter for finding desktops in XP [best I've seen is to look at DIMM type; if all your desktops have DIMMs and all your laptops have SODIMMs])