set group policy for users who both login to laptop as rdp server, how?

[RO|_F]

Hello,

We have SAP published via a remote desktop connection on our rdp servers.
We are going to set up laptop users to be member of active directory.
I will (have to!) set group policies on different OU's so that laptop users
don't get the same group policies that apply on the rdp servers.
Is this the (best) way to configure this:

create group 'rdp users'
create OU 'terminal servers'
create a GPO on this OU and apply the policy only to the group rdp users
make terminal users member of the 'rdp users' group

If this is a right set up, how can I prevent that a user that is not member
of the 'rdp users' group can login to a rdp server?

thanks for any help and regards,

Rolf
Utrecht, Netherlands

 

[Paul Bergson]

GPO's apply to users and machines. If you want to setup a gpo that is only
going to apply to certain users then place those users in this new ou and
apply this gpo to this ou. Otherwise you are going to have to take away
(NOT deny) the read and apply gpo permission for all users and provide read
and apply to the 'rdp users' group on the ou where these uses reside.

--


Paul Bergson MCT, MCSE, MCSA, CNE, CNA, CCA

This posting is provided "AS IS" with no warranties, and confers no rights.