Different group policy setup for room of computers problem!

[tarquel]

Hi all

 

Bit of a mystery going on here so let me explain... [grab a cup of tea/coffee/beer and concentrate on this one folks lol]

 

We have a suite of computers that are located in a seperate room [music room] from the rest of the school.

 

The network link is a strong wifi link [i have another thread long ago about this - the wifi works fine... moving on...] between the two buildings and things work through it as they should.

 

Now, I've put a replication DC from the cur server room to the music block and after trying with two lan cards to create a seperate range for the machines up there [in order to get them to logon to that server only] but just couldnt manage to get it running.

 

The next thing I thought was to just scrap that idea - as time is short - and even if they log onto the server in the cur room [...any way I can make those clients log onto the DC in the music room btw?...] I could set group policy to point folder redirection to the server in the music room i.e. for profiles etc, along with a home dir on this server [needed for them to save the huge music files - which wouldnt be very fun over wifi now ].

 

Been trying this part of the week and with the assistance of my replacement, we just cant get it to work :(

 

What our issue is is how to ONLY get a select group of computers i.e. music room computers to point to alterative set of folder redirection on a different server??

 

We tried using a WMI filter and triple-checked the settings of it... makes no difference.

 

The problem is that we need to tell the system via GP that when a user logs onto a computer in the music room to change the folder redirection to the server in the music room, but not when anywhere else...

 

Anyone have any ideas? as we are running low on them

 

cheers

Nath

[pooley]

Couldnt you just map a drive for use in he "music room" and tel he pupils/staff to save to that instead ?

[tarquel]

No.

 

As they will end up having to use a profile over a wifi connection, and Cubase took at least 5 minutes to load lol

 

As folder redirection is a user setting you must use loopback policy processing.

 

@Geoff: Merging the topics wasnt working so just quoting what you said.

 

Plus, thats already turned on.

[Geoff]

Plus, thats already turned on.

 

So are you defining folder redirection settings in your machine policys then?

[tarquel]

Geoff... were you refering to the setting in GP:

 

Computer Config > System > Group Policy:

User Group Policy loopback processing mode = Enabled

 

Is this what you mean?

 

I think a screenshot of the GP might be needed for you all here lol

 

Basically, with that set, it makes no difference... using Group Policy Modelling tells me the same thing... that the winning GPO for Folder Redirection is the "Default Staff User" policy i have, not the GPO that I have placed in Computer OU for the Music Room [that is outside of the main computer OU's] that has the Folder Redirection set differently. That GPO is forced whereas all the other GPO's relating to Folder Redirection aren't.

 

I so need this sorted... Any ideas?

 

Nath.

[Geoff]

Your half way there. You need to set the folder redirection settings in a policy that is applied to the machine. Consider the following screen shot.

[limbo]

Why does it have to be via GPO?

 

Could it not be something done in the login script using the computer name as the defining factor?

[tarquel]

If you have a script handy i can do it with then great... I only use batch scripts mainly though, so if its anything else, i need idiots guide for the time being

 

@geoff [and all]:

 

have a look at these attachments and see if there is something I am missing here...

 

[are security permissions needing to be changed at all?]

[limbo]

You could do it just with a batch script if that is what you are most comfortable with - what about a folder that has addtional batch files for these computers then:-

 

if exist \\folder\%computername%.bat \\folder\%computername%.bat

 

the relevant file could then delete the normal mapped share and create the new one.

[Geoff]

Looks fine to me.

[tarquel]

[btw What I scrubbed out is the servername and a hidden share]

 

Not sure what u mean limbo...

 

Basically, as u can see from the above screenshots, here's what i need:

 

- Application Data & Desktop to point to a share on the local DC

- My Documents to point to a different share on the local DC

- Start Menu to point to a set Start Menu on the local DC

 

With the exception of the Start Menu, all of those have %username% in them so each user is seperate of course.

 

The above settings in the GP look fine geoff, but as u can see, the default staff user GPO is "winning"... but i dont see why.

 

If a script is the best option, dont i need to tell the above settings the new location? Isn't that some sort of registry method and can I use %username% in it?

 

Cheers

Nath.

[fooby]

Hmm, posted earlier - never arrived.... but.

 

I didnt bother with WMI stuff but did similar with my terminal servers.

 

You will need

Sellotape*

Scissors*

GPMC

A couple of GPO's

 

Loopback policy processing needs to be set on the machines with a Machine GPO set to Replace

 

Part of this GPO on the OU with these machines needs a User section with the settings you want set.. set.

 

When a User logs on to these Computers, they will get the User part of the GPO that is attached to the Computer OU since Loopback processing is set and there are User settings to be applied.

 

hope this helps.

 

fooby

 

*P.S you don't really need these.

[tarquel]

Sellotape*

Scissors*

 

lol

 

Look at my screen shots... this is what I've got set.

 

But the Group Policy Modeling tests paint a different picture... i.e.... a picture that says that it doesnt work lol

 

Can we conclude that the Modellng system is flawed when it comes to certain things i wonder? :S

 

I shall try it on the actual machine in a bit.

 

Cheers

Nath

[Geoff]

Indeed, GPMC Modelling will not correctly model the RSOP for loop back policies. This is why I say they are evil.

[plexer]

tarquel: I tried this out for desktop folder redirection for someone else.

 

This thread http://www.edugeek.net/index.php?name=Forums&file=viewtopic&t=9466 has the details it was regarding a teacher and getting a different desktop depending on where they logged on.

 

I tested this in my virtual domain and it worked perfectly. I presume it would work for redirecting the other folders too.

 

Ben

[tarquel]

Yeah... tried that [WMI filtering] yesterday... for some reason, it wouldnt work - tho I'm thinking that loopback policy might have a bearing on it.

 

Gonna head on over to the music room to see whether anything has changed [no VNC on it yet lol ].

 

Nath

[plexer]

Thats the thing though tarquel in that it does apply how you would expect so something is not working quite right.

 

Ben

[tarquel]

It seems we have lift off!!

 

Loopback Policy on the actual GPO where the user settings are held is working... even though the Group Policy Modelling says otherwise

 

Thanks for the help guys.

Nath

[Geoff]

Yeah... tried that [WMI filtering] yesterday... for some reason, it wouldnt work

 

WMI filtering is for applying GPOs based on the machines capabilities. eg, so you don't deploy Photoshop elements on a machine with 128mb of ram and a 32mb graphics card. Or the XP resource kit on a W2k PC.

[tarquel]

Aye... but from what i read, you can do all sorts with it lol

 

i.e. if the machine name isnt "amonkey" then dont apply this GP [or vice versa]

 

I thought that sort of logic, amongst a whole host of stuff was possilble.

 

I read that it will only apply the GPO if the resultant WMI reads true.

 

But either way, its not important now :D

 

Nath.

[srochford]

WMI filtering is for applying GPOs based on the machines capabilities. eg, so you don't deploy Photoshop elements on a machine with 128mb of ram and a 32mb graphics card. Or the XP resource kit on a W2k PC.

 

It's more than just that (and not all of that - you couldn't do the XP resource kit thing because Windows 2000 doesn't know how to deal with WMI queries so basically the GPO will run whatever you do on a Windows 2000 machine!)

There are some good examples of WMI filtering at http://blogs.technet.com/johnbaker/archive/2006/02/22/420286.aspx

and if you want to find out about WMI in general then http://www.lissware.net/ is a good place to start. Alain seems to know more about WMI than anyone!

[limbo]

Not sure what u mean limbo..."

 

OK - had not appreaciated it was all on the local machine, I assumed you would want the start menu and desktop to still be on the server to make it easier to update and we were only talking about mapping the my documents to a local location but I think my theory can still apply which is basically:-

 

If my documents is a mapped drive - say h:\ and currently it is \\server\smithj but you want it to be on the local computer instead then you can map \\localcomputername\c$\userdocuments\smithj to h: instead (or other appropriate local folder)

 

To trigger this if your network login script has a line that looks for the existience of a local login script (c:\logon.bat for example) then it can run it (if exist c:\logon.bat c:\logon.bat)

 

That local c:\logon.bat file can then run additional commands to the main logon script and they can be custom to that particular PC (so can be used for a wide variety of things depending on that particular machines needs).

 

In this case it could unmap the normal my documents folder (net use h: /delete) and then map the local one (net use h: \\%computername%\c$\userdocuments\%username%\) - it could also check for the existence of the folder and create it too if needs be.

 

Another, easier ot administer option - which is the one I tried to explain previosuly but did not do very well - is instead of checking for a local batch file (c:\logon.bat) you could check a network location for a batch file that matches the name of the machine (\\server\customlogonscript\%computername%.bat) and run it. This makes it easier to get at the scripts and change them, plus back them up etc.

[ArchersIT]

Loopback Policy on the actual GPO where the user settings are held is working... even though the Group Policy Modelling says otherwise

 

This may be a "grandmother sucking eggs" post but when I was playing with loopback in Group Policy modelling it never worked until I noticed the check box to turn on loopback processing. Once I ticked this it behaved as expected.

 

I presume that it does not actually evaluate the policy and so does not know that it should be turned on for specific instances and so needs you to tell it.

 

Hope that helps.

 

Jonathan