group policy loopback with 2008 server

elitematrix
elitematrix used Ask the Experts™
on
one 2008 server with terminal service installed
5 xp client joined to domain
want group policy to only apply when user login to 2008 terminal server, dont what to apply to local machine

Tried loopback with replace option that only appply to ts user group , did not work policy apply to both local and terminal session


Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
tigermattSite Reliability Engineer
Most Valuable Expert 2011

Commented:

Can you please explain what you mean by not wanting it to apply to the local machine? Do you mean you don't want it to apply to users' XP workstations, or to users who logon locally at the console of the 2008 Terminal Server?

Making it only apply to users on the TS is easy - and you had the correct idea with the loopback policy. Move the Terminal Server to its own OU, then create and link a new policy in that OU. Set the User policies and then enable Loopback Processing, probably in Merge mode.

However, the other option, which I believe you are referring to, cannot be done. You cannot specify a Group Policy which only applies to remote Terminal Server sessions and not to local console sessions. Policies apply to the computer and its users, and that is that.
However, since only the Domain Administrators should be logging into the Terminal Server's console, you could use Security Filtering to indirectly stop the policy applying to Domain Admins - http://www.windowsnetworking.com/articles_tutorials/Group-Policy-Security-Filtering.html.

-Matt
Henrik JohanssonSystems engineer
Top Expert 2008

Commented:
As I understand it, the GPOs with user configuration settings have been linked to OU with user objects making them to affect the users when they log on to their local machines. When enabling the lopoback processing mode on the TS computer, user configuration settings will be applied when linking the user-GPOs to the OU with computer object. Combine it with security filtering on the GPO to only affect a group of users instead of all users logging on to the machine.

Author

Commented:
Tigermatt


I dont what it apply to user's workstation (  not ts console )

I already create New OU and move the TSERVER , and lik it with GPO that i created( loopback with replace ), and only assign it to
Terminal Server User Group ( removed Authenticated Users )

Still does'nt work

** i did exact same with 2003 Server No Problem ( I only have this problem with  2008 server )
How to Generate Services Revenue the Easiest Way

This Tuesday! Learn key insights about modern cyber protection services & gain practical strategies to skyrocket business:

- What it takes to build a cloud service portfolio
- How to determine which services will help your unique business grow
- Various use-cases and examples

tigermattSite Reliability Engineer
Most Valuable Expert 2011

Commented:

As I understand it, you are looking for the policy to only apply to the users when they log in to the TS Server, not to their workstations. If so, loopback policy is your friend.

Are you sure the policy is ONLY linked to the Terminal Server OU? If you look at the policy properties in Group Policy Management, do you see any other links anywhere in the domain?

-Matt

Author

Commented:
no other link, i even block inherit , like i said i did exeactly same as 2003 server (  only 2008 not working )
tigermattSite Reliability Engineer
Most Valuable Expert 2011

Commented:

Where did you block inheritance? If you blocked it on the Terminal Server OU, that will stop inheritance of policies to that OU but won't prevent User policies applying to the user objects elsewhere in the Group Policy structure.

If it is configured the same as 2003 Server then the loopback policy should be working. Can you confirm whether it is not working at all (not even on the TS) or whether it is simply a case of it is applying to users on EVERY machine? If it doesn't work at all, that would indicate an issue in loopback mode being enabled or some other Group Policy problem.

Is Loopback Policy in Replace or Merge mode?

-Matt

Author

Commented:
2 lab tests for TS alone and TS/DC server together for 2008 Std 32bit
1) TS server <-- apply group policy with loopback (replace)
2) TS/DC server <--apply group policy with loopback (replace)

Group name: TSgroup <contain user: test>
ie. user: test

Local workstation, when login into the domain as user test, the policy kicked and loopback doesn't work.

Remote to TS server, the policy kicked, which is right.

Question is why the local workstation when logging in locally, the loopback doesn't kick in? Why did the TS policy activate?

2003 server, works fine, but in 2008 loopback doesn't work.
tigermattSite Reliability Engineer
Most Valuable Expert 2011

Commented:

It's interesting it isn't working on a Server 2008 box. What policies is it applying? Standard Group Policy settings or things such as Logon/Logoff scripts?

Commented:
Hello,

Here the same problem, configure following:

SBS 2008 on one server
TS 2008 on other server

Link on DC loopback policy (replace) to OU TS server

Login on TS no policy is applied for the user.

What is going in 2008 ????
tigermattSite Reliability Engineer
Most Valuable Expert 2011

Commented:

Where are you applying the 'Replace' policy? It should be IN THE GPO APPLYING TO THE TERMINAL SERVER, not on any GPO applying to the Domain Controller.

-Matt

Commented:
Hello Matt,

Thanks for helping, with here a pdf with all what I have done, maybe you see a mistake.

Loopback-Policy-Terminal-Server-.pdf
Site Reliability Engineer
Most Valuable Expert 2011
Commented:

Okay, first of all, take out 'TS Users' from Security Filtering and put 'Authenticated Users' back in. There's actually no requirement to filter the policy using Security Group, because it is linked to your Terminal Server OU. Thus, it will only apply to the Terminal Server. With loopback enabled, this means the user settings will also only apply to users on the Terminal Server.

Other than that, it should work correctly.

-Matt

Commented:
Thanx Matt,

Works now, but why it wouldn't work with TS users in it ?

Also must i put still the ts server in the security filter, or only 'Authenticated Users'.

Now I have only 'Authenticated Users' in it and it's work :)

-Martin
tigermattSite Reliability Engineer
Most Valuable Expert 2011

Commented:

You don't need Security Filtering. The policy is applying to the Terminal Server OU and then the loopback allows the User settings to apply. Since it isn't applying to user objects, the Security Filtering doesn't work properly.

-Matt

Commented:
He Matt,
One question, now also the policy is applied by the administrator.

How can I prevent that, will only applied it by some users.

-Martin


tigermattSite Reliability Engineer
Most Valuable Expert 2011

Commented:

You might be able to stop it by going to the 'Delegation' tab on the policy, clicking the 'Advanced' button, then adding 'Administrator' with 'Apply Group Policy' DENIED. I haven't tested this so don't know whether it will work.

-Matt

Commented:

Hello Matt,

The policy on the admin account works (complete), but when I put it on deny, it will still takes the policy.

For the other users, still the policy is not complete applied.
Loopback-Policy.pdf
tigermattSite Reliability Engineer
Most Valuable Expert 2011

Commented:

I think you really need to ask your own question, as that's something wrong with your GPO rather than the loopback setting.

As for locking it down so it doesn't apply to an Administrator, I'm almost certain you can't due to the way the policy is applying.

-Matt

Commented:
He Matt,

All working now, have removed the policy and link, start over again.

Now all is working perfect thanx for your input made

-Martin

Author

Commented:
This work.
"take out 'TS Users' from Security Filtering and put 'Authenticated Users' back in"

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial