Solved

Seperating group policy from workstation and terminal server

Posted on 2011-03-01
5
689 Views
Last Modified: 2012-08-13
      I have users at a remote site that are logged in to the domain via VPN, They also use remote desktop connection from that workstation to connect to Terminal server to do their work. Because of certain software we run the users have to be local administrators on the TS, this poses a problem because they can then shut off the TS. To prevent this we set up a group policy for terminal server users, this worked fine and removed the option to shut down on the terminal server. Unfortunately they have also lost the ability to shut down on their workstation as well. Is there any way to limit this policy to the TS ONLY?
0
Comment
Question by:Mcottuli
5 Comments
 
LVL 39

Expert Comment

by:Krzysztof Pytko
ID: 35007710
You can create separate OU and move there TS servers. Link GPO to that OU. Or use GPO Security Filtering to apply GPO only to TS server(s)
More about GPO Security Filtering at
http://www.windowsnetworking.com/articles_tutorials/Group-Policy-Security-Filtering.html

or you can try doing this with my guide (for process overview)
 Group-Policy-Security-Filtering.pdf

Regards,
Krzysztof
0
 
LVL 11

Expert Comment

by:Tasmant
ID: 35007726
You should activate LoopBack processing mode on a GPO assigned to your server.
therefore each user connecting to your TSE server will receive only user part settings assigned on your TSE GPO.

Review this : http://www.experts-exchange.com/Software/Server_Software/File_Servers/Active_Directory/A_1876-Understanding-Group-Policy-Loopback-Processing.html
0
 
LVL 11

Accepted Solution

by:
yelbaglf earned 500 total points
ID: 35007759
This setting is a User Config setting, which means it applies to the user and not the computer/server.  The way to resolve this is to have your terminal servers in a separate OU.

From there, you set your group policy up on the term svcs OU and use loopback policy processing, so that it only applies to the users when they are logged into a terminal server.
http://support.microsoft.com/kb/231287
0
 
LVL 1

Author Comment

by:Mcottuli
ID: 35011617
Well I have enabled the group policy loopback processing mode. Created a new OU with the TSE in it and moved the Terminal server users policy into that OU. But I don't know how to link the loopback to the new TSE OU. Excuse my ignorance I'm reletiviely new to AD.
0
 
LVL 11

Expert Comment

by:yelbaglf
ID: 35011771
Under your Group Policy Mgmt console...

GPMC > Forest > Domain > 'TSE OU'

Right-Click this OU, and choose Link an Existing GPO.  Then choose your newly created GPO.
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

A procedure for exporting installed hotfix details of remote computers using powershell
This article explains the steps required to use the default Photos screensaver to display branding/corporate images
This tutorial will show how to push an installation of Backup Exec to an additional server in both 2012 and 2014 versions of the software. Click on the Backup Exec button in the upper left corner. From here, select Installation and Licensing, then I…
This tutorial will walk an individual through locating and launching the BEUtility application and how to execute it on the appropriate database. Log onto the server running the Backup Exec database. In a larger environment, this would generally be …

808 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question