one 2008 server with terminal service installed
5 xp client joined to domain
want group policy to only apply when user login to 2008 terminal server, dont what to apply to local machine
Tried loopback with replace option that only appply to ts user group , did not work policy apply to both local and terminal session
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
As I understand it, the GPOs with user configuration settings have been linked to OU with user objects making them to affect the users when they log on to their local machines. When enabling the lopoback processing mode on the TS computer, user configuration settings will be applied when linking the user-GPOs to the OU with computer object. Combine it with security filtering on the GPO to only affect a group of users instead of all users logging on to the machine.
Tigermatt
I dont what it apply to user's workstation ( not ts console )
I already create New OU and move the TSERVER , and lik it with GPO that i created( loopback with replace ), and only assign it to
Terminal Server User Group ( removed Authenticated Users )
Still does'nt work
** i did exact same with 2003 Server No Problem ( I only have this problem with 2008 server )
As I understand it, you are looking for the policy to only apply to the users when they log in to the TS Server, not to their workstations. If so, loopback policy is your friend.
Are you sure the policy is ONLY linked to the Terminal Server OU? If you look at the policy properties in Group Policy Management, do you see any other links anywhere in the domain?
-Matt
Where did you block inheritance? If you blocked it on the Terminal Server OU, that will stop inheritance of policies to that OU but won't prevent User policies applying to the user objects elsewhere in the Group Policy structure.
If it is configured the same as 2003 Server then the loopback policy should be working. Can you confirm whether it is not working at all (not even on the TS) or whether it is simply a case of it is applying to users on EVERY machine? If it doesn't work at all, that would indicate an issue in loopback mode being enabled or some other Group Policy problem.
Is Loopback Policy in Replace or Merge mode?
-Matt
2 lab tests for TS alone and TS/DC server together for 2008 Std 32bit
1) TS server <-- apply group policy with loopback (replace)
2) TS/DC server <--apply group policy with loopback (replace)
Group name: TSgroup <contain user: test>
ie. user: test
Local workstation, when login into the domain as user test, the policy kicked and loopback doesn't work.
Remote to TS server, the policy kicked, which is right.
Question is why the local workstation when logging in locally, the loopback doesn't kick in? Why did the TS policy activate?
2003 server, works fine, but in 2008 loopback doesn't work.
Okay, first of all, take out 'TS Users' from Security Filtering and put 'Authenticated Users' back in. There's actually no requirement to filter the policy using Security Group, because it is linked to your Terminal Server OU. Thus, it will only apply to the Terminal Server. With loopback enabled, this means the user settings will also only apply to users on the Terminal Server.
Other than that, it should work correctly.
-Matt
Business Accounts
Answer for Membership
by: tigermattPosted on 2009-07-18 at 04:58:16ID: 24885696
Can you please explain what you mean by not wanting it to apply to the local machine? Do you mean you don't want it to apply to users' XP workstations, or to users who logon locally at the console of the 2008 Terminal Server?
Making it only apply to users on the TS is easy - and you had the correct idea with the loopback policy. Move the Terminal Server to its own OU, then create and link a new policy in that OU. Set the User policies and then enable Loopback Processing, probably in Merge mode.
However, the other option, which I believe you are referring to, cannot be done. You cannot specify a Group Policy which only applies to remote Terminal Server sessions and not to local console sessions. Policies apply to the computer and its users, and that is that.
However, since only the Domain Administrators should be logging into the Terminal Server's console, you could use Security Filtering to indirectly stop the policy applying to Domain Admins - http://www.windowsnetworki
-Matt