GPO setup - Personalization Screensaver


I am trying to figure out how to setup a GPO that will lock down ALL my users ability to change screensaver and assign a specific screensaver by default. I have tested this through assigning to users configuration within GPO settings, however I cannot get it to work within computer settings. I'm trying to assign GPO to the computer instead of users. I want the ability to add users and filter them out from this policy, for those users that have approval. What is the best way to accomplish this?


Jaime CamposAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Jeff GloverSr. Systems AdministratorCommented:
Create a GPO with the user settings. In the computer settings, under Administrative Templates/System/Group Policy, Enable Use Group Policy Loopback processing Mode. Set it to Merge. Assign that Group Policy to an OU containing the Computer accounts (not a good idea to do it at the domain level). Loopback means that every user on the computer will have the user settings in that GPO applied along with their other User GPOs.
You can also select Replace and it will apply the user settings in that GPO instead of the users GPOs. Useful for Kiosks and such.
Jaime CamposAuthor Commented:
Man you really helped me! I am trying to understand better....when you say merge allows computer to have the user settings in the GPO applied along with their other user GPO, I'm confused as to how this is different from regular GPO functionality. What does that mean? Then replace will apply user settings in that GPO instead of the users GPO. Man I'm lost, sorry. I need to dumb it down a bit. Great explanation, but I'm trying to fully understand why. THANKS!!!!! This came up today cause our audit department came to me to modify our existing lock down policy and prevent users from modifying screensaver and also set default. I only was able to perform it via user configuration when I attempted to modify computer it didn't have the option to modify screensaver which not sure why?
Jeff GloverSr. Systems AdministratorCommented:
Here is the 5 cent explanation. Group Policy really means Policy settings grouped together and applied. There are 2 containers in Group Policy, Computer and User. in essence these are separate containers and are processed at different times. when a computer starts up, it queries for all group policy objects in its hierarchy. First Site level, then domain, then OU level. It looks for settings in the Computer configuration container only and applies them in that order. Any conficts overwrite the ones before.
  when the user logs on, they do the same thing but they get the list of Group policy objects in their hierarchy, same order. Site, Domain, OU and only apply the settings in the user container of the GPOs found there.
  The computer and user do not have to be in the same OU. They do not have to be in the same Domain even, just the same forest.
  So, given this, Loopback processing is a way to modify this. When it is set to enabled and Merge, the computer will actually set the policy settings contained in the User Configuration Container of the GPO with the Loopback setting. The settings stay there when the user logs on so as long as you do not overwrite them with User settings in other applied GPOs, they take effect for everyone.
  If you set Loopback to Replace, then the user configuration settings in the GPO with the loopback settings are applied on the computer and it locks out User GPO processing so only the settings in the Loopback GPO get applied.
  I hope this helps. I am trying to take a 5 hour class and condense it.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Jaime CamposAuthor Commented:
You successfully gave a class in 5 min. Thank you so much. I will try it in the morning. I truly appreciate it.
Jaime CamposAuthor Commented:
Perfect explanation!
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Active Directory

From novice to tech pro — start learning today.