Desktop Redirection using Security Groups - not working as XP :(

[kennysarmy]

Slight conundrum here.....

 

Currently testing win7 and building up policies from scratch and using WMI filtering.

 

Servers are 2003 DC's and I am running a win7 machine to create the policies.

 

I created a desktop redirection policy as per our XP version and logged in as a student and it successfully gives the correct desktop for students. I don't worry about the start menu as I redirect that to the same "location".

 

I am using Security Groups ie the setting "Advanced - Specify locations for various user groups"

 

Domain\Pupils - path = \\server\pupils\desktop

Domain\Staff - path = \\server\staff\desktop

 

This is exactly as it is set in XP but on my Win7 test PC the test teacher logon gets the pupil desktop.

 

Pupils are in the following security groups: Domain Users & Pupils

Staff are in : Domain Users, Pupils & Staff

 

It's as if the policy is seeing that the staff are in the Pupils Security group but not "seeing" like XP does that the Staff Security group should take priority...

 

Any ideas?

[Willott]

Only resolution I could think of is to have two separate GPOs and use the GPO targetting for pupils/staff to do this - then stick the staff gpo at higher priority in group policy management. When you've got staff in the pupils group you're going to hit this issue - any reason for them being in this?

[kennysarmy]

tbh I think it's historic and has presumably sorted problems in the past - I am reluctant to change this as it may have a detrimental effect on current operation of our existing XP clients...

 

good idea about 2 GPO's targetting the specific groups - first though I am going to try disabling all other GPO's except the redirection one to see what happens.

 

I wonder how come XP works then? lol how does it KNOW to set the staff desktop based on the "higher" staff group - must be a setting somewhere - I am sure it's not just choosing it at random....

 

Hmmmm

[Chunks_]

We used the WMi filtering to direct windows 7 policys seperate to windows xp. When we started adding windows 7 PC's we had no filtering. After setting it up i made sure all the original policies were filtered for xp and then made new ones for windows 7 and filtered them to 7 (we skipped vista) This has worked fine for us so hopefully u should be ok too.