<div>
Similar issue<br />
<br />
<a href="https://www.experts-exchange.com/questions/22108945/Problems-with-windows-2003-Group-policy-to-terminal-servers-using-security-filters-and-Containers.html" rel="ugc">https://www.experts-exchange.com/questions/22108945/Problems-with-windows-2003-Group-policy-to-terminal-servers-using-security-filters-and-Containers.html</a>
</div>


<div>
Well - I wen through that thread and checked all my settings, and it appears I've done everything the same. &nbsp;But when I log on remotely to a Term Server, and check the gpresult, the expected policy does not get applied. Very strange. &nbsp;
</div>


<div>
Run the group policy modeling wizard and see if its applying or what is applying.<br />
<br />
I have also seen removing policies and rebuilding them fixes the issue.<br />
I would also check replication. &nbsp;If you have multiple dc's and one of them doesnt have the GP that could also be an issue.<br />
Check dcdiag and netdiag
</div>


<div>
I will try removing and recreating the policy. &nbsp;Standby, and thanks.
</div>


<div>
I deleted the GPO and recreated it, to no avail. &nbsp;When logging on as a non-admin user, the shutdown button and control panel are still available, which are the main things I'm trying to restrict. &nbsp;I'm attaching the screen shots of the GPO and AD screens, to perhaps shed some light. &nbsp;Am I supposed to enforce the policy? &nbsp;I have that checked, even though it was not the default setting.<br />
<br />
Thanks<br />
<a href="https://filedb.experts-exchange.com/incoming/2008/07_w30/44431/gpresult-on-terminal-server-LACO.jpg" target="_blank" class="file-inline" title="Results of GPRESULT on Term Server (89 KB)"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512"><path d="M67.508 468.467c-58.005-58.013-58.016-151.92 0-209.943l225.011-225.04c44.643-44.645 117.279-44.645 161.92 0 44.743 44.749 44.753 117.186 0 161.944l-189.465 189.49c-31.41 31.413-82.518 31.412-113.926.001-31.479-31.482-31.49-82.453 0-113.944L311.51 110.491c4.687-4.687 12.286-4.687 16.972 0l16.967 16.971c4.685 4.686 4.685 12.283 0 16.969L184.983 304.917c-12.724 12.724-12.73 33.328 0 46.058 12.696 12.697 33.356 12.699 46.054-.001l189.465-189.489c25.987-25.989 25.994-68.06.001-94.056-25.931-25.934-68.119-25.932-94.049 0l-225.01 225.039c-39.249 39.252-39.258 102.795-.001 142.057 39.285 39.29 102.885 39.287 142.162-.028A739446.174 739446.174 0 0 1 439.497 238.49c4.686-4.687 12.282-4.684 16.969.004l16.967 16.971c4.685 4.686 4.689 12.279.004 16.965a755654.128 755654.128 0 0 0-195.881 195.996c-58.034 58.092-152.004 58.093-210.048.041z"/></svg>gpresult-on-terminal-server-LACO.jpg</a><br />
<a href="https://filedb.experts-exchange.com/incoming/2008/07_w30/44432/active-directory-screen.jpg" target="_blank" class="file-inline" title="Screen shot of the AD Users & Computers (70 KB)"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512"><path d="M67.508 468.467c-58.005-58.013-58.016-151.92 0-209.943l225.011-225.04c44.643-44.645 117.279-44.645 161.92 0 44.743 44.749 44.753 117.186 0 161.944l-189.465 189.49c-31.41 31.413-82.518 31.412-113.926.001-31.479-31.482-31.49-82.453 0-113.944L311.51 110.491c4.687-4.687 12.286-4.687 16.972 0l16.967 16.971c4.685 4.686 4.685 12.283 0 16.969L184.983 304.917c-12.724 12.724-12.73 33.328 0 46.058 12.696 12.697 33.356 12.699 46.054-.001l189.465-189.489c25.987-25.989 25.994-68.06.001-94.056-25.931-25.934-68.119-25.932-94.049 0l-225.01 225.039c-39.249 39.252-39.258 102.795-.001 142.057 39.285 39.29 102.885 39.287 142.162-.028A739446.174 739446.174 0 0 1 439.497 238.49c4.686-4.687 12.282-4.684 16.969.004l16.967 16.971c4.685 4.686 4.689 12.279.004 16.965a755654.128 755654.128 0 0 0-195.881 195.996c-58.034 58.092-152.004 58.093-210.048.041z"/></svg>active-directory-screen.jpg</a><br />
<a href="https://filedb.experts-exchange.com/incoming/2008/07_w30/44433/group-policy-screen-shot.jpg" target="_blank" class="file-inline" title="Screen shot of the GPO policy in question (79 KB)"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512"><path d="M67.508 468.467c-58.005-58.013-58.016-151.92 0-209.943l225.011-225.04c44.643-44.645 117.279-44.645 161.92 0 44.743 44.749 44.753 117.186 0 161.944l-189.465 189.49c-31.41 31.413-82.518 31.412-113.926.001-31.479-31.482-31.49-82.453 0-113.944L311.51 110.491c4.687-4.687 12.286-4.687 16.972 0l16.967 16.971c4.685 4.686 4.685 12.283 0 16.969L184.983 304.917c-12.724 12.724-12.73 33.328 0 46.058 12.696 12.697 33.356 12.699 46.054-.001l189.465-189.489c25.987-25.989 25.994-68.06.001-94.056-25.931-25.934-68.119-25.932-94.049 0l-225.01 225.039c-39.249 39.252-39.258 102.795-.001 142.057 39.285 39.29 102.885 39.287 142.162-.028A739446.174 739446.174 0 0 1 439.497 238.49c4.686-4.687 12.282-4.684 16.969.004l16.967 16.971c4.685 4.686 4.689 12.279.004 16.965a755654.128 755654.128 0 0 0-195.881 195.996c-58.034 58.092-152.004 58.093-210.048.041z"/></svg>group-policy-screen-shot.jpg</a>
</div>


active-directory-screen.jpg

Screen shot of the GPO policy in question

group-policy-screen-shot.jpg

gpresult-on-terminal-server-LACO.jpg

<div>
You have a &quot;User COnfiguration&quot; section in your group policy, but the OU on which it is applied doesn't have any user accounts. Move the user account with which you are testing to the Terminal Services Unit.<br />
<br />
Run gpupdate /force and login again with the non-admin account.
</div>


<div>
Oh - I thought that the policy would apply to the computer and then to the user who logs on to it, due to the loopback setting. &nbsp;If I move users there, will that change their current default domain policies?
</div>


Remote-Users.doc

<div>
Bingo. &nbsp;That was it. &nbsp;I was using other setting that I thought would remove the Shutdown button. &nbsp;Thanks Ryansoto. &nbsp;Interstingly, the GPRESULT doesn't show the policy as being applied, but that must be normal.<br />
<br />
Thanks to all for your efforts.<br />

</div>


<div>
One other side question - how do I prevent the policy from applying to admins?
</div>


<div>
<div class="content wysiwyg-content">
Hello. &nbsp;We have a Terminal Server that seems to be ignoring a GPO policy, in spite of the server being placed in the OU. &nbsp;I created an OU named &quot;Terminal Services Unit&quot;, and under that is a GPO policy named &quot;Local Security Restrictions&quot;. &nbsp;the policy is &quot;linked&quot; and &quot;enabled&quot;, and also has Loopback enabled. &nbsp;But nothing seems to be applied when logging on with any user. &nbsp;Also - the terminal server computer (named LACOTS1) is under the Terminal Services Unit folder in Active Directory Users and Computers. &nbsp;I'm not sure what is wrong. &nbsp;Any help would be much appreciated.<br />
<br />
Thank you
</div>
</div>


Hello.  We have a Terminal Server that seems to be ignoring a GPO policy, in spite of the server being placed in the OU.  I created an OU named "Terminal Services Unit", and under that is a GPO policy named "Local Security Restrictions".  the policy is "linked" and "enabled", and also has Loopback enabled.  But nothing seems to be applied when logging on with any user.  Also - the terminal server computer (named LACOTS1) is under the Terminal Services Unit folder in Active Directory Users and Computers.  I'm not sure what is wrong.  Any help would be much appreciated.

Thank you

Group Policy not being applied on users logging onto a Terminal Server

Operating system security (OS security) is the process of ensuring OS integrity, confidentiality and availability. OS security refers to specified steps or measures used to protect the OS from threats, viruses, worms, malware or remote hacker intrusions. OS security encompasses all preventive-control techniques, which safeguard any computer assets capable of being stolen, edited or deleted if OS security is compromised, including authentication, passwords and threats to systems and programs.

OS Security

Active Directory (AD) is a Microsoft brand for identity-related capabilities. In the on-premises world, Windows Server AD provides a set of identity capabilities and services, and is hugely popular (88% of Fortune 1000 and 95% of enterprises use AD). This topic includes all things Active Directory including DNS, Group Policy, DFS, troubleshooting, ADFS, and all other topics under the Microsoft AD and identity umbrella.

Active Directory

Windows Server 2003 was based on Windows XP and was released in four editions: Web, Standard, Enterprise and Datacenter. It also had derivative versions for clusters, storage and Microsoft’s Small Business Server. Important upgrades included integrating Internet Information Services (IIS), improvements to Active Directory (AD) and Group Policy (GP), and the migration to Automated System Recovery (ASR).