Settings while on Domain vs. while on Terminal Services

[Shawn]

Hello,

One of our users is getting a new laptop (XP Pro tablet
PC edition) whose old laptop had WinME. The user used to
log directly on to our domain (W2k servers) while at the
facility for half the week, and also logged on via
Terminal Services (RDP)on a dial-up connection while
traveling the rest of the time. The login info has been
the same for both environments. The Terminal Services
session is incredibly locked down and only 2 programs are
allowed (a database program and Outlook). The
organizational unit security settings had no affect on
the user when logged in onto the network directly while
at the facility becuase WinME isn't affected by it.

However, now that the user has a new XP machine, the
security settings implemented in the organizational unit
ARE affecting and restricting the user's login straight
onto the domain while in the office.

What can I do to retain the same login information, but
keep the environments different? I don't want to remove
all the restrictions on the Terminal Services session
becuase the user is logging on to the server (obviously)
and I don't want them accidentally doing something
wrong.

Thanks for your help!

Shawn

 

[Vera Noest [MVP]]

What you need is "loopback processing" of the GPO. Details are
here:

260370 - How to Apply Group Policy Objects to Terminal Services
Servers
http://support.microsoft.com/?kbid=260370

231287 - Loopback Processing of Group Policy
http://support.microsoft.com/?kbid=231287