Solved

Seperating group policy from workstation and terminal server

Posted on 2011-03-01
5
688 Views
Last Modified: 2012-08-13
      I have users at a remote site that are logged in to the domain via VPN, They also use remote desktop connection from that workstation to connect to Terminal server to do their work. Because of certain software we run the users have to be local administrators on the TS, this poses a problem because they can then shut off the TS. To prevent this we set up a group policy for terminal server users, this worked fine and removed the option to shut down on the terminal server. Unfortunately they have also lost the ability to shut down on their workstation as well. Is there any way to limit this policy to the TS ONLY?
0
Comment
Question by:Mcottuli
5 Comments
 
LVL 39

Expert Comment

by:Krzysztof Pytko
ID: 35007710
You can create separate OU and move there TS servers. Link GPO to that OU. Or use GPO Security Filtering to apply GPO only to TS server(s)
More about GPO Security Filtering at
http://www.windowsnetworking.com/articles_tutorials/Group-Policy-Security-Filtering.html

or you can try doing this with my guide (for process overview)
 Group-Policy-Security-Filtering.pdf

Regards,
Krzysztof
0
 
LVL 11

Expert Comment

by:Tasmant
ID: 35007726
You should activate LoopBack processing mode on a GPO assigned to your server.
therefore each user connecting to your TSE server will receive only user part settings assigned on your TSE GPO.

Review this : http://www.experts-exchange.com/Software/Server_Software/File_Servers/Active_Directory/A_1876-Understanding-Group-Policy-Loopback-Processing.html
0
 
LVL 11

Accepted Solution

by:
yelbaglf earned 500 total points
ID: 35007759
This setting is a User Config setting, which means it applies to the user and not the computer/server.  The way to resolve this is to have your terminal servers in a separate OU.

From there, you set your group policy up on the term svcs OU and use loopback policy processing, so that it only applies to the users when they are logged into a terminal server.
http://support.microsoft.com/kb/231287
0
 
LVL 1

Author Comment

by:Mcottuli
ID: 35011617
Well I have enabled the group policy loopback processing mode. Created a new OU with the TSE in it and moved the Terminal server users policy into that OU. But I don't know how to link the loopback to the new TSE OU. Excuse my ignorance I'm reletiviely new to AD.
0
 
LVL 11

Expert Comment

by:yelbaglf
ID: 35011771
Under your Group Policy Mgmt console...

GPMC > Forest > Domain > 'TSE OU'

Right-Click this OU, and choose Link an Existing GPO.  Then choose your newly created GPO.
0

Featured Post

Courses: Start Training Online With Pros, Today

Brush up on the basics or master the advanced techniques required to earn essential industry certifications, with Courses. Enroll in a course and start learning today. Training topics range from Android App Dev to the Xen Virtualization Platform.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article explains how to install and use the NTBackup utility that comes with Windows Server.
Last week, our Skyport webinar on “How to secure your Active Directory” (https://www.experts-exchange.com/videos/5810/Webinar-Is-Your-Active-Directory-as-Secure-as-You-Think.html) provided 218 attendees with a step-by-step guide for identifying Acti…
To efficiently enable the rotation of USB drives for backups, storage pools need to be created. This way no matter which USB drive is installed, the backups will successfully write without any administrative intervention. Multiple USB devices need t…
This video shows how to use Hyena, from SystemTools Software, to bulk import 100 user accounts from an external text file. View in 1080p for best video quality.

786 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question