Solved

Terminal Server GPO not being applied

Posted on 2007-03-19
8
1,253 Views
Last Modified: 2013-12-04
I am trying to implement a GPO that will only affect users in the remote operators group who are connected to our terminal server.  This way I can really screw down security and the desktop but still allow the administrator full access with no restrictions.

Here is what I have done so far.

* in AD I've created a Terminal Server OU and moved the terminal server into it.
* I've created a GPO called Terminal Server Policy and enabled loopback processing.  
* I added remote operators to the GPO's security filtering.
* I setup all the various things in the GPO I'd like to see effect these remote users.

When I log in as a remote user, however, none of the settings have been applied.
I check gpresult and it doesn't even show the GPO as being applied.

What am I overlooking?
0
Comment
Question by:hindsight
  • 4
  • 3
8 Comments
 
LVL 16

Assisted Solution

by:kshays
kshays earned 125 total points
ID: 18750236
Have you refreshed the gpo on the terminal server?  

gpupdate /force

0
 
LVL 1

Author Comment

by:hindsight
ID: 18750272
Yes.
I've used gpupdate /force and have even rebooted in frustration just to make sure.

It seems like everything should be right but it's just not going through.
If I add authorized users to the security filtering then do gpupdate and gpresult I can see the policy being applied.  I don't, however, want it to apply to everyone - just remote users.  Once I remove all the authorized users and tell it to use only remote operators I get nothing.

Logged in at the console as administrator and issuing gpresult I'm seeing this:

Applied Group Policy Objects
-----------------------------
    Default Domain Policy
    Local Group Policy

The following GPOs were not applied because they were filtered out
-------------------------------------------------------------------
    Terminal Server Policy
        Filtering:  Not Applied (Unknown Reason)
0
 
LVL 3

Accepted Solution

by:
antonaf earned 125 total points
ID: 18750378
Have you done a gpudate /force on the domain controller and then on the terminal server itself.  If you have multiple AD's then perform a gpupdate on each AD, because it depends where the terminal server gets it policy from.  You can open a command prompt on the terminal server and type 'set' to get the logon server it connects to.  Reboot the terminal server so it is assured you receive the update.

If all else fails try changing the local terminal server GPO to reflect the same as the domain controller (AD).
0
 
LVL 16

Assisted Solution

by:kshays
kshays earned 125 total points
ID: 18750439
Ok, you have created a security group called "ts_remote_users" or something similar and then added that group to the local "remote desktop users" group on the terminal server?  Removed "authenticated users" from the security filtering and replaced it with "ts_remote_users" or whatever security group you created?

To add the group to the local remote power user group issue the following at the command prompt on the TS.

net localgroup "remote desktop users" domain\group /add

Kevin


0
How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

 
LVL 1

Author Comment

by:hindsight
ID: 18750507
Okay I seem to have resolved the issue myself.
I'm still not sure why this works 100% but it is.

I added the actual machine name (lets just call it SERVER) to the security filter of the GPO and now it is applying itself.  It's also only now applying itself to the remote users.  It must be adding the computer to the policy, processing, and failing when it finds admin not part of the remote users.  It is, however, addint the computer to the policy and processing the user group once an actual remote users logs in.

I was under the impression that by linking the GPO to the OU that contains the computer that this was already assumed by the policy.
0
 
LVL 16

Assisted Solution

by:kshays
kshays earned 125 total points
ID: 18750546
I still think you have to have the name of the computer listed or "domain computers" listed if it's all the computers such as in default domain policy.

Cheers.

Kevin
0
 
LVL 1

Author Comment

by:hindsight
ID: 18750625
I'll split the value - thanks for the effort!
0
 
LVL 16

Expert Comment

by:kshays
ID: 18750870
Thanks.  No problem.  Have a good one.

Kevin
0

Featured Post

IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

Our Group Policy work started with Small Business Server in 2000. Microsoft gave us an excellent OU and GPO model in subsequent SBS editions that utilized WMI filters, OU linking, and VBS scripts. These are some of experiences plus our spending a lo…
Container Orchestration platforms empower organizations to scale their apps at an exceptional rate. This is the reason numerous innovation-driven companies are moving apps to an appropriated datacenter wide platform that empowers them to scale at a …
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…
This video shows how to remove a single email address from the Outlook 2010 Auto Suggestion memory. NOTE: For Outlook 2016 and 2013 perform the exact same steps. Open a new email: Click the New email button in Outlook. Start typing the address: …

747 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

9 Experts available now in Live!

Get 1:1 Help Now