• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 269
  • Last Modified:

Apply Group Policy depending on group membership?

I have some people who normally have very restricted access to things, locked down desktops, etc., for most of their work day.  I am locking the desktop down through the use of User based group policy settings, not Computer based group policy settings.  Is it possible to prevent the desktop from being locked down if the user logs into a particular workstation or group of workstations?
0
CousinDupree
Asked:
CousinDupree
  • 5
  • 4
  • 2
1 Solution
 
oBdACommented:
Yes; put these machines into their own OU, and enable the Loopback policy for this OU; set the Loopback setting to Replace (reboot the machines after this). New *user* policies linked to this OU will now apply to all users logging no to these machines, regardless of where their accounts are. Check here for details:
Loopback Processing of Group Policy
http://support.microsoft.com/?kbid=231287
0
 
KCTSCommented:
I'm confused by the title of the question - the solution given by oBdA will certainly work but quite what your question has to do with the title has me perplexed
>> Apply Group Policy depending on group membership << 

This is possible with security filtering http://technet2.microsoft.com/windowsserver/en/library/65424a58-aff3-4e1e-a3a1-59878cbcf0051033.mspx
0
 
CousinDupreeAuthor Commented:
I had initially thought I would try to apply a group policy based on a combination of the OU of user and if they were a member of a particular AD security group or not.  As I wrote the question, I thought I might be attempting to do something that was either impossible, or could be solved more easily through a method toher than the one I was proposing.  So, I decided to make my goal more generic and see what was suggested.  I neglected to change my title....
0
SMB Security Just Got a Layer Stronger

WatchGuard acquires Percipient Networks to extend protection to the DNS layer, further increasing the value of Total Security Suite.  Learn more about what this means for you and how you can improve your security with WatchGuard today!

 
KCTSCommented:
... It happens :-)
0
 
CousinDupreeAuthor Commented:
If I enable loopback processing, is it possible to not apply a user based policy for administrators?  Since I am locking down the desktop, I would like to have the workstation be open if an administrator logs on to it.  I suppose I could move the workstation to an OU that didn't have loopback processing enabled if I needed to, but it would be nice to not need to.
0
 
oBdACommented:
You can use security group filtering for this: create a group "GPO-RestrictedUsers" or whatever, add the users that should be restricted, and replace the default "Authenticated Users" in the permissions for the GPO with this group. That way, only members of this group will be restricted.
Another possibility would be to open the Advanced permissions in the Delegation tab of the GPMC, and Deny the "Apply" permission to the Administrators group.
0
 
CousinDupreeAuthor Commented:
Is it possible to enable loopback processing, and implement security filtering on the user policy that is being applied through the loopback processing?
0
 
oBdACommented:
Yes, that's why I suggested it.
For your own convenience, do as I (well, after a fashion) suggested in my first post: create a policy *only* for loopback (and other *computer* configuration settings), add/link *new* GPOs for *user* configuration policies (and configure permissions on these user GPOs).
The loopback policy does *NOT* have to be in the same GPO as the user policies you want to implement!
0
 
CousinDupreeAuthor Commented:
I hate to ask, but in your first post, you say to create an OU for the machines in question, and enable the loopback processing option for the OU.  Is this done by enabling the loopback processing option in a policy linked to that OU?  And in your last post you mention that the loopback policy does not have to be in the same GPO as the user policies I wish to implement, are you saying that any user GPOs that are linked to an OU, that has a policy linked to it that has loopback processing enabled, will apply all the user settings contained within those linked policy objects?

I guess I am confused about how I am to enable loopback processing on an OU...
0
 
oBdACommented:
Yes, the loopback policy is a computer policy and will be applied to all computer objects in or under the OU to which it is linked (unless you combine it with a security filtering group, which will work for computer accounts as well - note that if you add a computer account to a group, the machine needs to be restarted for the group membership change to be applied!).
And yes, as I said, once a Loopback is applied to a machine, all user configuration policies applied to this machine will be applied to all users logging on to this machine, regardless of where the user account resides in AD (again, unless the GPO is combined with a security filtering group).
Yes, loopback processing can be somewhat confusing until you get the hang of it.
0
 
CousinDupreeAuthor Commented:
Thank you for your patience and thoroughness.
0

Featured Post

Free tool for managing users' photos in Office 365

Easily upload multiple users’ photos to Office 365. Manage them with an intuitive GUI and use handy built-in cropping and resizing options. Link photos with users based on Azure AD attributes. Free tool!

  • 5
  • 4
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now