Preventing Policy applying to Computers

[Peter]

We have a remote office where the users connect using Remote Access
connections to a Windows 2003 Server running Terminal Services in the head
office.

We have a fairly simple policy at the domain level which prevents remote
clients from accessing local disks on the Terminal Server, disables Shutdown
button, some folder redirection for desktop etc.

In the security properties of the policy at the domain level the 'apply
group policy' is set to 'Allow' for a Global Group with the members being
the remote clients.

All the users in the remote office need to use a terminal connection for
certain functions but a handful of workstations also need a full workstation
installation to allow running of some specific local applications plus
connection of scanners, digital cameras etc.

These workstations are about to be upgraded to Windows XP. They will need to
have full access to local disks and shutdown button etc but in my testing I
have been unable to prevent the domain level policy from being applied to
the XP computers. I have created an OU and moved the XP computers into it
and have created a Global group with the XP Computers as members. I have
set up a policy in the OU to be applied to the XP Computers global group. I
have also tried adding the XP Computers Global group to the domain level
policy with deny permissions. I have tried using the 'loopback' option in
the OU's policy all without success.

When I test with resultant set of policies (Planning) both policies are
still being applied.

Essentially what I want to be able to do is have policies in place where a
user can log on to a Windows XP workstation without the domain level policy
being applied but the user can still connect from the same XP computer as a
terminal client and have the domain level policy on the terminal server
apply.

Many Thanks
Peter Moore

 

[Steven L Umbach]

Hi Peter.

You want to use loopback processing of group policy that will apply user
configuration settings for an OU to all users that logon to computers in that OU in
either a replace or merge mode. I suggest that you create an Organizational Unit with
it's own GPO for your TS. Configure user configuration as you want it for users that
logon that server and then enable loopback processing in computer configuration for
that GPO. Then disable the settings at the domain level that you do not want to apply
to users in general logging onto other computers. The link below should be
elpful. --- Steve

http://support.microsoft.com/default.aspx?scid=kb;en-us;231287