Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

So we have a GPO setup to redirect "My Documents" to a server location for all users in the domain (it's linked to the root "Users" OU). This works just fine, but we have 2 special workstations that numerous users login to which need to NOT inherit this policy. I understand that the folder redirection policies are user-based but I don't understand how we'd go about denying this user policy for specific computer objects in AD. As these users are moving back and forth between these "special" systems and regular systems on the network, we cannot simply exclude specific users from the root policy.

I created a loopback processing policy (set to "replace") for the OU these 2 systems reside in and linked a separate "Disable My Documents redirection" GPO to this OU, but the root-level user-based redirection policy still wins (or causes my test user account login to hang forever on "applying personal settings"). Is there a way I can override this?

share|improve this question

4 Answers 4

Your comment that the root policy is winning against your test GPO, this is an issue of GPO presidence. You need to switch the presidence, or set the GPO to be enforced. To do this: in the tree listing on the left within GPMC seelct the OU where your policy is linked, this will display on the right a order of presidence for your GPOs which can be edited.

share|improve this answer
    
Thanks for the suggestion. Looking at the "Group Policy Inheritance" tab for the OU containing these 2 special workstations, I see our "My Documents Redirection - Disable" policy at a precedence of 4 while the "Enable" policy is down below at number 8. In theory, this is how we want it. In practice, running GPResult on the workstations still shows that both policies are being applied, one at the computer level (disable) and the other at the user level (enable). I assume the user policy is winning because My Docs are still redirected and not changeable in the properties window. –  Matthew Flook Oct 20 '10 at 17:20
up vote 1 down vote accepted

Not exactly sure whose answer is right at this point, as it was my own fault for having a User policy in the root OU applying to all users and computer objects. I think a smart combination of Security Filtering and Inheritance/Precedence configuration could have worked around this if I had more time to test but the real fix was to move the GPO out of the root so that it no longer interferes with the policies and loopback processing on the special computers OU.

share|improve this answer
    
Your issue was two-fold, by my guess. The first was that having the GPO to perform folder redirection at the root of your domain was causing the computer to pick up that GPO during loopback policy processing. Moving that GPO was probably the best fix (rather than doing something ugly like using "Block Inheritance"). The second issue was that, I suspect, your "Disable My Documents redirection" GPO had the various folder redirection settings set to "Not Configured". That won't "undo" another GPO higher in the GPO processing order that has folder redirection settings specified. (cont'd) –  Evan Anderson Oct 21 '10 at 1:10
    
The only way to "undo" those folder redirection settings would be to create a GPO with a "Basic" folder redirection policy for each previously-redirected folder set to "Redirect to the local userprofile location". You're really better off just moving the folder redirection GPO, as you've done, out of the path of the computer's "Replace" loopback policy processing. (How did my psychic powers do re: guessing the contents of your "Disable My Documents redirection" GPO, anyway?) –  Evan Anderson Oct 21 '10 at 1:11
    
Good call. You should mark your answer as accepted, since you found the solution. –  Cypher Oct 21 '10 at 2:35
    
Nice guess, Evan. :) But I had actually configured my "disable" policy to correctly "redirect to local userprofile" as you suggested. I think yet another issue with my configuration was that I also had that policy set to "move contents to new location" which - across a VPN on a very slow DSL connection - was very unwise! This would likely explain some login hangs I mentioned in my original request. I have since disabled that setting. –  Matthew Flook Oct 21 '10 at 17:31

Apply a policy on the two machines to force only local profiles. You can find the polciy here: Computer Configuration\Administrative Templates\System\Logon\Only allow local user profiles

share|improve this answer
    
Don't think my issue has anything to do with local vs. roaming profiles. –  Matthew Flook Oct 18 '10 at 21:30
    
Reading your question again, I think you're right. –  edusysadmin Oct 20 '10 at 1:42
    
The original question was regarding folder redirection, not roaming profiles. Don't feel bad -- a lot of people confuse the two concepts. When roaming profiles are used, it's often a good idea to use folder redirection as well, to reduce network traffic during roaming profile synchronization. –  Jonathan J Feb 17 '12 at 16:17

I'm not entirely positive this will work - more just theory, but couldn't you use the GPO Security Filtering for this?

The GPO is linked to the Users OU, and the Security Filtering by default applies to all Authenticated Users. So any Authenticated User within the Users OU will get this GPO applied to them.

To extend the Security Filtering a bit further, you could create a security group (let's call it Group Alpha) for all the computers that you want the policy to apply to and make all of your, as you put it, regular systems members of Group Alpha, with the exception of these two "special" systems. Then modify your GPO by adding Group Alpha to the Security Filter.

Again, just a thought - but in theory, that would cause your GPO to only apply to Authenticated Users within the Users OU using computers that are members of Group Alpha.

Of course, I could be completely misinterpreting how the Security Filter works, so you'll have to experiment. :-) And even if it does work, you'll have to make sure all your systems that you want this policy apply to are members of Group Alpha going forward.

Here's an alternative suggestion, since the above didn't work:

Is it possible to apply this GPO to the computers itself? If so, you could give Evan's suggestion a try and put the computers that you want exempted from the redirection into their own OU, and blocking inheritance on that OU. A little funky, but might work.

share|improve this answer
    
Thanks, I'll give this a shot today. Sounds logical. –  Matthew Flook Oct 18 '10 at 21:28
    
The Security Filtering feature does seem to work in the way you describe, but for some reason not with the way our policies were laid out - I think due to the use of loopback processing in the special computer OU. Ultimately, I ended up moving the "my docs redirection" policy from the root company OU (not sure why it was there) to the Users OU so that it wouldn't ever apply down to any computer objects. Now my "redirection disable" policy appears to be working on those two systems! Thanks! –  Matthew Flook Oct 21 '10 at 0:28
    
-1 - This won't work, though you think it might. The "Loopback group policy processing" setting is a computer setting, but when the loopback processing is being performed the context of the user being logged-on is used, not the computer. As such, denying the computer the right to apply the offending policies won't help at all and you can't deny the user the rights to apply the policies or the policies won't work for that user anywhere. –  Evan Anderson Oct 21 '10 at 1:15
2  
If you ever get stuck in the situation of really needing this functionality you're pretty much stuck to putting the computer into an OU marked for "Block inheritance" and applying all the various GPOs from higher-up in the domain, EXCEPT the offending GPO, to that "Block inheritance" OU. If the offending GPO is marked "No override", though, there's no way even using "Block inheritance" to accomplish what you're looking for. –  Evan Anderson Oct 21 '10 at 1:16
    
Not sure why that deserved a down-vote - I clearly noted that the suggested was hypothetical. :) Although, I don't think it will help to block inheritance on the computers, since the GPO is applied to users. Updating my answer with another suggestion. –  Cypher Oct 21 '10 at 2:29

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.