dcohn
asked on
Managing Terminal Service via Group Policy Issue
I am having some issues getting a program to properly start running that I have defined in a group policy.
If I set the same program on the users Terminal Service Profile setting the program starts as planned. But if I set it in Group Policy it does not.
I have made sure I do not have any settings which would overide the program starting and have read many detailed articles on the subject.
It seems very odd but maybe I am missing something obvious.
I do not have al lot of TS experience but generally know my ay around a network.
This is a small domain with about 25 users accesing the TS. Some of them access it via a WEB PAGE set up to point to the server while others use Remote Desktop. I am NOT on the same domain when I connect to Terminal services.
Is there a delay with getting a GPO to take effect for users not on the domain?
Thanks for the assistance
If I set the same program on the users Terminal Service Profile setting the program starts as planned. But if I set it in Group Policy it does not.
I have made sure I do not have any settings which would overide the program starting and have read many detailed articles on the subject.
It seems very odd but maybe I am missing something obvious.
I do not have al lot of TS experience but generally know my ay around a network.
This is a small domain with about 25 users accesing the TS. Some of them access it via a WEB PAGE set up to point to the server while others use Remote Desktop. I am NOT on the same domain when I connect to Terminal services.
Is there a delay with getting a GPO to take effect for users not on the domain?
Thanks for the assistance
GregMoseley
I'm not sure what you mean by getting a program to start properly when you refer to the Terminal Server Profile.. but, are you logging in with an account that is in the same domain as the Terminal Server or with an account in a trusted domain/forest?
ASKER
Sorry MY Mistake
I was referring the the Environment tab for the user. In the environment tab if I set an application to start it works as planned. But if I set it in a GPO under Windows components/Terminal Services / Start a program on Connection
Program Path and file name
Working directory
It does not start.
I do not have any other policy set except for the time limits under
Windows components/Terminal Services/Sessions
Logging on with an account that is in the same domain as the terminal server YES. Created a specific OU for each group of users as one group is actually logged onto the domain while the other group is remote and the users only use the terminal server.
The only issue is that the users are getting a full desktop and I want them to get just the application. I do not want to set each user independently.
I have used these same settings at several other locations and they just work. Really was very simple. This location has proved a different story.
I was referring the the Environment tab for the user. In the environment tab if I set an application to start it works as planned. But if I set it in a GPO under Windows components/Terminal Services / Start a program on Connection
Program Path and file name
Working directory
It does not start.
I do not have any other policy set except for the time limits under
Windows components/Terminal Services/Sessions
Logging on with an account that is in the same domain as the terminal server YES. Created a specific OU for each group of users as one group is actually logged onto the domain while the other group is remote and the users only use the terminal server.
The only issue is that the users are getting a full desktop and I want them to get just the application. I do not want to set each user independently.
I have used these same settings at several other locations and they just work. Really was very simple. This location has proved a different story.
"Is there a delay with getting a GPO to take effect?"
"Computer Group Policy is updated in the background every 90 minutes by default, with a random offset of 0 to 30 minutes. In addition to background updates, computer Group Policy is always updated when the system starts"
You can force a refresh of the policy using gpupdate.exe from the command line on the server.
"Is there a delay with getting a GPO to take effect for users not on the domain?"
Not in your case because the users that are not part of the domain are logging in to a TS this is in a domain using a domain account from the same domain, there will be no affect on how the group policy is applied.
I am assuming you have waited for more than 90 minutes for the policy to take affect?
"Windows components/Terminal Services / Start a program on Connection"
Is this under the User Configuration section of the GPO?
When you are testing the connection, are you connecting to the console of the server using RDC? (mstsc /console)
"Computer Group Policy is updated in the background every 90 minutes by default, with a random offset of 0 to 30 minutes. In addition to background updates, computer Group Policy is always updated when the system starts"
You can force a refresh of the policy using gpupdate.exe from the command line on the server.
"Is there a delay with getting a GPO to take effect for users not on the domain?"
Not in your case because the users that are not part of the domain are logging in to a TS this is in a domain using a domain account from the same domain, there will be no affect on how the group policy is applied.
I am assuming you have waited for more than 90 minutes for the policy to take affect?
"Windows components/Terminal Services / Start a program on Connection"
Is this under the User Configuration section of the GPO?
When you are testing the connection, are you connecting to the console of the server using RDC? (mstsc /console)
ASKER
When you are testing the connection, are you connecting to the console of the server using RDC? (mstsc /console)
Of course not. I am testing it as a user in one of the OU's with the GPO applied.
I do not follow the logic of this statement
"Is there a delay with getting a GPO to take effect for users not on the domain?"
Not in your case because the users that are not part of the domain are logging in to a TS this is in a domain using a domain account from the same domain, there will be no affect on how the group policy is applied.
I am assuming you have waited for more than 90 minutes for the policy to take affect?
Why would I wait 90 minutes if there is no delay?
Nonetheless I have tested it the next day with the same results. I am thinking I need to open a ticket with Microsoft. There is nothing wrong with the GPO's that are setup yet they do not run. I have run resultant set etc etc and examined them carefully with equal confusion.
Of course not. I am testing it as a user in one of the OU's with the GPO applied.
I do not follow the logic of this statement
"Is there a delay with getting a GPO to take effect for users not on the domain?"
Not in your case because the users that are not part of the domain are logging in to a TS this is in a domain using a domain account from the same domain, there will be no affect on how the group policy is applied.
I am assuming you have waited for more than 90 minutes for the policy to take affect?
Why would I wait 90 minutes if there is no delay?
Nonetheless I have tested it the next day with the same results. I am thinking I need to open a ticket with Microsoft. There is nothing wrong with the GPO's that are setup yet they do not run. I have run resultant set etc etc and examined them carefully with equal confusion.
"Of course not. I am testing it as a user in one of the OU's with the GPO applied. "
Just checking as a console connection will ignore the launch application setting.
Can you make a more obvious setting within the GPO (Desktop Wallpaper or something) to confirm the GPO is applying?
Just checking as a console connection will ignore the launch application setting.
Can you make a more obvious setting within the GPO (Desktop Wallpaper or something) to confirm the GPO is applying?
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.