2

I might be asking the impossible here, as I understand it "Computer Settings" are only applied once when the computer first boots up.

What I would like to do is have different policy restrictions applied that are within Computer Settings depending upon where a user is in a particular OU. This is because this one computer acts as a Terminal Server and is used by multiple users at any one given time.

My aim here is for different Terminal Services policies to be applied with regard to sharing the clipboard and drives. I want some "powerful" users to be able to share their local drives with the terminal server, and I want other lesser users to not be able to share their local drives with the terminal server.

Is there any way I can achieve my aim?

3
  • can you be more specific in terms of what settings you want to manage? there might a hackish way to accomplish that.
    – KAPes
    Feb 15, 2010 at 23:01
  • I want administrators to have permissions to share clipboard data, drives, etc through the RDP client to the TS. Admins are in their own OU with users inside. I want other users not to have permission to share clipboard data, drives, etc through the RDP client. Other users all have the parent OU of Staff. I have found these settings under Computer Settings -> Administration Templates -> Windows Components -> Terminal Services -> Client/Server Data Redirection. These policies are perfect, but I can only set them globally on the terminal server computer object, which is in its own OU.
    – tentuxius
    Feb 16, 2010 at 22:44
  • I'm looking for the same or similar thing - you ever find an answer? If anyone knows a way to write a WMI query (or is is WQL?) to grab the logging on user's OU I think we could use WMI filter on the GPO to do it.
    – Jordan W.
    May 7, 2010 at 13:47

1 Answer 1

1

No.

The opposite can be done (having specific user policies always apply to the same computer regardless of which user logs on to it), but not what you're asking for here.

2
  • Are there any commercial security applications that would allow me to set policies in the way I want to?
    – tentuxius
    Feb 16, 2010 at 19:52
  • Due to the way AD policies work, I really don't think this can be done...
    – Massimo
    Feb 16, 2010 at 20:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .