Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I might be asking the impossible here, as I understand it "Computer Settings" are only applied once when the computer first boots up.

What I would like to do is have different policy restrictions applied that are within Computer Settings depending upon where a user is in a particular OU. This is because this one computer acts as a Terminal Server and is used by multiple users at any one given time.

My aim here is for different Terminal Services policies to be applied with regard to sharing the clipboard and drives. I want some "powerful" users to be able to share their local drives with the terminal server, and I want other lesser users to not be able to share their local drives with the terminal server.

Is there any way I can achieve my aim?

share|improve this question
can you be more specific in terms of what settings you want to manage? there might a hackish way to accomplish that. – KAPes Feb 15 '10 at 23:01
I want administrators to have permissions to share clipboard data, drives, etc through the RDP client to the TS. Admins are in their own OU with users inside. I want other users not to have permission to share clipboard data, drives, etc through the RDP client. Other users all have the parent OU of Staff. I have found these settings under Computer Settings -> Administration Templates -> Windows Components -> Terminal Services -> Client/Server Data Redirection. These policies are perfect, but I can only set them globally on the terminal server computer object, which is in its own OU. – tentuxius Feb 16 '10 at 22:44
I'm looking for the same or similar thing - you ever find an answer? If anyone knows a way to write a WMI query (or is is WQL?) to grab the logging on user's OU I think we could use WMI filter on the GPO to do it. – Jordan W. May 7 '10 at 13:47


The opposite can be done (having specific user policies always apply to the same computer regardless of which user logs on to it), but not what you're asking for here.

share|improve this answer
Are there any commercial security applications that would allow me to set policies in the way I want to? – tentuxius Feb 16 '10 at 19:52
Due to the way AD policies work, I really don't think this can be done... – Massimo Feb 16 '10 at 20:27

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.