Remote desktop connection and Group Policy

[Guest]

Hello,

Is it possible to have group policy applied to a terminal service session?
I am running Win2k Server with Win XP workstations. When I logged on with a
user account using remote desktop connection none of the group policies
settings were applied. Thank you.

 

[Vera Noest [MVP]]

Yes, put the TS in a separate OU (and make sure that the user
accounts and client computer accounts are in another OU), link the
GPO to the OU containing the TS and use loopback processing of the
GPO, with the "Replace" option.
Details here:

260370 - How to Apply Group Policy Objects to Terminal Services
Servers
http://support.microsoft.com/?kbid=260370

231287 - Loopback Processing of Group Policy
http://support.microsoft.com/?kbid=231287

 

[Guest]

Hello Vera,

Just want to make sure I understand correctly. When a remote desktop
connection is established to a Win 2k server the user GPO is applied first
then the computer GPO is applied next, which has a higher priority thus
overriding the user's GPO, correct? So I am basically duplicating the same
policies for the computer GPO to match the user's GPO because those are the
policies I want applied.

Just out of curiosity what happens if the computer is in the same OU as the
user?

Thank you.

 

[Vera Noest [MVP]]

If the user account is in the same OU, the (presumably restrictive)
GPO will affect the user also when he logs into his own
workstation. That is normally not what you want.

Example: normally, you want to hide the Terminal Server C:-drive
from the users during a TS session, but you don't want to hide the
C:-drive on the workstation from the user during the workstation
logon.
By configuring "Hide C: drive" in a TS-specific policy, with
"loopback processing", you assure that the rectriction is only
applied when the user logs on to the TS.

--
Vera Noest
MCSE, CCEA, Microsoft MVP - Terminal Server
http://hem.fyristorg.com/vera/IT
--- please respond in newsgroup, NOT by private email ---