Terminal Server GPO not being applied

Posted on 2007-03-19
Last Modified: 2013-12-04
I am trying to implement a GPO that will only affect users in the remote operators group who are connected to our terminal server.  This way I can really screw down security and the desktop but still allow the administrator full access with no restrictions.

Here is what I have done so far.

* in AD I've created a Terminal Server OU and moved the terminal server into it.
* I've created a GPO called Terminal Server Policy and enabled loopback processing.  
* I added remote operators to the GPO's security filtering.
* I setup all the various things in the GPO I'd like to see effect these remote users.

When I log in as a remote user, however, none of the settings have been applied.
I check gpresult and it doesn't even show the GPO as being applied.

What am I overlooking?
Question by:hindsight
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 3
LVL 16

Assisted Solution

by:Kevin Hays
Kevin Hays earned 125 total points
ID: 18750236
Have you refreshed the gpo on the terminal server?  

gpupdate /force


Author Comment

ID: 18750272
I've used gpupdate /force and have even rebooted in frustration just to make sure.

It seems like everything should be right but it's just not going through.
If I add authorized users to the security filtering then do gpupdate and gpresult I can see the policy being applied.  I don't, however, want it to apply to everyone - just remote users.  Once I remove all the authorized users and tell it to use only remote operators I get nothing.

Logged in at the console as administrator and issuing gpresult I'm seeing this:

Applied Group Policy Objects
    Default Domain Policy
    Local Group Policy

The following GPOs were not applied because they were filtered out
    Terminal Server Policy
        Filtering:  Not Applied (Unknown Reason)

Accepted Solution

antonaf earned 125 total points
ID: 18750378
Have you done a gpudate /force on the domain controller and then on the terminal server itself.  If you have multiple AD's then perform a gpupdate on each AD, because it depends where the terminal server gets it policy from.  You can open a command prompt on the terminal server and type 'set' to get the logon server it connects to.  Reboot the terminal server so it is assured you receive the update.

If all else fails try changing the local terminal server GPO to reflect the same as the domain controller (AD).
Does Your Cloud Backup Use Blockchain Technology?

Blockchain technology has already revolutionized finance thanks to Bitcoin. Now it's disrupting other areas, including the realm of data protection. Learn how blockchain is now being used to authenticate backup files and keep them safe from hackers.

LVL 16

Assisted Solution

by:Kevin Hays
Kevin Hays earned 125 total points
ID: 18750439
Ok, you have created a security group called "ts_remote_users" or something similar and then added that group to the local "remote desktop users" group on the terminal server?  Removed "authenticated users" from the security filtering and replaced it with "ts_remote_users" or whatever security group you created?

To add the group to the local remote power user group issue the following at the command prompt on the TS.

net localgroup "remote desktop users" domain\group /add



Author Comment

ID: 18750507
Okay I seem to have resolved the issue myself.
I'm still not sure why this works 100% but it is.

I added the actual machine name (lets just call it SERVER) to the security filter of the GPO and now it is applying itself.  It's also only now applying itself to the remote users.  It must be adding the computer to the policy, processing, and failing when it finds admin not part of the remote users.  It is, however, addint the computer to the policy and processing the user group once an actual remote users logs in.

I was under the impression that by linking the GPO to the OU that contains the computer that this was already assumed by the policy.
LVL 16

Assisted Solution

by:Kevin Hays
Kevin Hays earned 125 total points
ID: 18750546
I still think you have to have the name of the computer listed or "domain computers" listed if it's all the computers such as in default domain policy.



Author Comment

ID: 18750625
I'll split the value - thanks for the effort!
LVL 16

Expert Comment

by:Kevin Hays
ID: 18750870
Thanks.  No problem.  Have a good one.


Featured Post

Free Tool: IP Lookup

Get more info about an IP address or domain name, such as organization, abuse contacts and geolocation.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Learn about cloud computing and its benefits for small business owners.
OfficeMate Freezes on login or does not load after login credentials are input.
Michael from AdRem Software outlines event notifications and Automatic Corrective Actions in network monitoring. Automatic Corrective Actions are scripts, which can automatically run upon discovery of a certain undesirable condition in your network.…
Monitoring a network: how to monitor network services and why? Michael Kulchisky, MCSE, MCSA, MCP, VTSP, VSP, CCSP outlines the philosophy behind service monitoring and why a handshake validation is critical in network monitoring. Software utilized …
Suggested Courses

626 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question