Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win

x
?
Solved

Loopback GPO for Citrix is not working

Posted on 2012-12-27
8
Medium Priority
?
1,016 Views
Last Modified: 2013-01-01
Hello,

I am trying to apply my first "loopback" policy on my Citrix server. The policy I want to implement is to hide the Citrx server's local drives (C&D)

I have read several articles on how to do this, and followed them step-by-step but can not get it to work. Here is what I have done:

1. I created a new OU and moved a Citrix server in there. (I have other Citrix servers but for now I only want the local drives on this one hidden.)

2. In this OU, I created a GPO called "Loopback." User configuration has been disabled and "User group policy loopback processing mode" has been enabled and set to "merge."

3. Next, I created another GPO called "Hide Local Drives" and it is linked to the same OU the Citrix server is in.

4. Computer configuration settings have been disabled for this GPO and the setting to hide drives A though D has been selected.

5. In the security tab of the “Hide Local Drives” GPO I unchecked “Read” and “Apply Group Policy” for Authenticated Users I added two test user accounts and checked  the “Read” and “Apply Group Policy.” (Note, these test user accounts are in another OU and used just for testing.)

6. On the Citrix server, I ran  “gpupdate /force” and even restarted the server and still cannot get the loopback policy to work. If I link the GPO directly to the OU where my test user accounts, the GPO works but then it hides even the local drives to workstations (defeating the purpose of the loopback.)

Any suggestions as to what I may be missing?

A little bit about what I'm working with:
Citrix XenApp 6.0 running on Windows Server 2008 64-bit
0
Comment
Question by:smoker49
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 3
8 Comments
 
LVL 44

Expert Comment

by:Amit
ID: 38723686
can you create test user in same OU and check again.
0
 
LVL 24

Expert Comment

by:Dirk Kotte
ID: 38723803
your config looks good for me.

use gpresult.msc or the group policy result wizzard to check if the gpo and the settings would be applied to the user.
try to disable the user or machine part of the gpo's later, some times there are a mistake.
0
 

Author Comment

by:smoker49
ID: 38724023
In response to amitkulshrestha, if I move my test user ID into the OU where my Citrix server is, yes, the policy is applied.
0
Get free NFR key for Veeam Availability Suite 9.5

Veeam is happy to provide a free NFR license (1 year, 2 sockets) to all certified IT Pros. The license allows for the non-production use of Veeam Availability Suite v9.5 in your home lab, without any feature limitations. It works for both VMware and Hyper-V environments

 
LVL 44

Expert Comment

by:Amit
ID: 38724054
0
 

Author Comment

by:smoker49
ID: 38724304
I ran the the Group Policy Results wizard set to my Citrix server and my test user ID.
The Loopback policy gets applied and looks ok.

The "hide local drive" policy is what is not working. The report under "user configuration summary lists it under the section of "Denied GPO's showing the Unique ID instead of the name of the GPO and says it's "Inaccessible."
I checked once again, and made sure my test user ID has read and apply group policy security settings.

Any idea why the GPO is "inaccessible?"
0
 

Accepted Solution

by:
smoker49 earned 0 total points
ID: 38724441
I figured out what the problem was. Contrary to a set of instructions I was following to uncheck "read" and "apply group" policy for Authenticated Users for the GPO and give it to the security group instead is not working. I gave Authenticated Users the "read" permission and my loopback policy now seems to be working fine.
0
 
LVL 44

Expert Comment

by:Amit
ID: 38724450
Great you found the issue.
0
 

Author Closing Comment

by:smoker49
ID: 38734230
The configuration of the loopback policy may differ from what other users do.
0

Featured Post

Fill in the form and get your FREE NFR key NOW!

Veeam® is happy to provide a FREE NFR server license to certified engineers, trainers, and bloggers.  It allows for the non‑production use of Veeam Agent for Microsoft Windows. This license is valid for five workstations and two servers.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

If you're a modern-day technology professional, you may be wondering if certifications are really necessary. They are. Here's why.
A bad practice commonly found during an account life cycle is to set its password to an initial, insecure password. The Password Reset Tool was developed to make the password reset process easier and more secure.
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
This video shows how to use Hyena, from SystemTools Software, to update 100 user accounts from an external text file. View in 1080p for best video quality.

636 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question