NT4 users authenticating to an AD Domain

[Art]

I have a Terminal Server that belongs to a Windows 2000
Active Directory Domain (Domain A). In Domain A, I have
an OU with the Terminal Server in it to apply Group
Policies. I've enable "loop back processing" and "delete
locally cached copies of roaming profiles" in the
machine_policy, and have "add logoff to the start menu"
enabled in the user_policy. Domain A users are getting
all three of those policies applied to them, no issues.
There are also two other domain (Domain B, Active
Direcotry), and (Domain C, NT4.0) Domain B and C can
login to the Terminal Server in Domain A with their
respective Domains selected at the login screen, however
the group policies are not applying to these users.
Within the security of the Group Policy in Domain A, I
can't browse and add Domain B users, I can browse and add
Domain C users (NT 4.0 users) and once I did that the
machine policies were working for Domain C users, but not
the user policies, as in their roaming profiles got
deleted, but they didn't see logoff on their start menu.
My question is, why can't I browse and add Domain B users
to the Domain A Policy, I'm not sure what kinds of trusts
they have set up in their environment. And why can I add
the NT 4 domain user accounts to Domian A's Group Policy,
but the user policy doesn't effect these users. The
overall question is where do I start troubleshooting this?

Regards,
-Art

 

[David Fisher [MSFT]]

Hello Art.

There appears to be a few reasons why groups policies are not behaving as
expected.

First, the loopback policy only applies when both the computer and user
account belong to Active Directory domains. In the case of the NT domain
user account, loopback application will not occur.
231287 Loopback Processing of Group Policy
http://support.microsoft.com/?id=231287

Second, I would suggest ensuring that Domain A's clients/servers are able to
resolve DNS queries for Domain B's resources. There are many options to
allow for this... zone transfers from B to A, etc.

If this fails to correct the issue between B users logging on to A's
Terminal Server, you can enable diagnostic logging for group policy
application (on the Terminal Server):
245422 How to Enable Logging for Security Configuration Client Processing in
http://support.microsoft.com/?id=245422
and
221833 How to Enable User Environment Debug Logging in Retail Builds of
Windows
http://support.microsoft.com/?id=221833

David Fisher
Enterprise Platform Support