Terminal Server GPO not being applied

Posted on 2007-03-19
Last Modified: 2013-12-04
I am trying to implement a GPO that will only affect users in the remote operators group who are connected to our terminal server.  This way I can really screw down security and the desktop but still allow the administrator full access with no restrictions.

Here is what I have done so far.

* in AD I've created a Terminal Server OU and moved the terminal server into it.
* I've created a GPO called Terminal Server Policy and enabled loopback processing.  
* I added remote operators to the GPO's security filtering.
* I setup all the various things in the GPO I'd like to see effect these remote users.

When I log in as a remote user, however, none of the settings have been applied.
I check gpresult and it doesn't even show the GPO as being applied.

What am I overlooking?
Question by:hindsight
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 3
LVL 16

Assisted Solution

kshays earned 125 total points
ID: 18750236
Have you refreshed the gpo on the terminal server?  

gpupdate /force


Author Comment

ID: 18750272
I've used gpupdate /force and have even rebooted in frustration just to make sure.

It seems like everything should be right but it's just not going through.
If I add authorized users to the security filtering then do gpupdate and gpresult I can see the policy being applied.  I don't, however, want it to apply to everyone - just remote users.  Once I remove all the authorized users and tell it to use only remote operators I get nothing.

Logged in at the console as administrator and issuing gpresult I'm seeing this:

Applied Group Policy Objects
    Default Domain Policy
    Local Group Policy

The following GPOs were not applied because they were filtered out
    Terminal Server Policy
        Filtering:  Not Applied (Unknown Reason)

Accepted Solution

antonaf earned 125 total points
ID: 18750378
Have you done a gpudate /force on the domain controller and then on the terminal server itself.  If you have multiple AD's then perform a gpupdate on each AD, because it depends where the terminal server gets it policy from.  You can open a command prompt on the terminal server and type 'set' to get the logon server it connects to.  Reboot the terminal server so it is assured you receive the update.

If all else fails try changing the local terminal server GPO to reflect the same as the domain controller (AD).
Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

LVL 16

Assisted Solution

kshays earned 125 total points
ID: 18750439
Ok, you have created a security group called "ts_remote_users" or something similar and then added that group to the local "remote desktop users" group on the terminal server?  Removed "authenticated users" from the security filtering and replaced it with "ts_remote_users" or whatever security group you created?

To add the group to the local remote power user group issue the following at the command prompt on the TS.

net localgroup "remote desktop users" domain\group /add



Author Comment

ID: 18750507
Okay I seem to have resolved the issue myself.
I'm still not sure why this works 100% but it is.

I added the actual machine name (lets just call it SERVER) to the security filter of the GPO and now it is applying itself.  It's also only now applying itself to the remote users.  It must be adding the computer to the policy, processing, and failing when it finds admin not part of the remote users.  It is, however, addint the computer to the policy and processing the user group once an actual remote users logs in.

I was under the impression that by linking the GPO to the OU that contains the computer that this was already assumed by the policy.
LVL 16

Assisted Solution

kshays earned 125 total points
ID: 18750546
I still think you have to have the name of the computer listed or "domain computers" listed if it's all the computers such as in default domain policy.



Author Comment

ID: 18750625
I'll split the value - thanks for the effort!
LVL 16

Expert Comment

ID: 18750870
Thanks.  No problem.  Have a good one.


Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

No security measures warrant 100% as a "silver bullet". The truth is we also cannot assume anything but a defensive and vigilance posture. Adopt no trust by default and reveal in assumption. Only assume anonymity or invisibility in the reverse. Safe…
ADCs have gained traction within the last decade, largely due to increased demand for legacy load balancing appliances to handle more advanced application delivery requirements and improve application performance.
In an interesting question ( here at Experts Exchange, a member asked how to split a single image into multiple images. The primary usage for this is to place many photographs on a flatbed scanner…

752 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question