Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there any way to specify a Group Policy only for the users who are members of a trusted active directory domain?

share|improve this question
up vote 5 down vote accepted

Any user policy that applies to them is going to come out of the domain their account is a member of, unless you're overriding user policy processing with loopback policy processing.

Computer policy is going to come from the domain that the computer they are logging-on to is a member of.

Are you thinking something like this? "When one of these users from domain ABC logs-on to one of the computers that is a member of domain XYZ I'd like to have certain group policy settings apply. When an ABC user logs-on to an ABC computer, though, I don't want those settings to apply. When an XYZ user logs-on to an XYZ computer, I don't want those settings to apply either."

If so, then there's no way with simple group policy to do what you're describing. You could mimic the functions of group policy with a script that checked the logon domain of the user, but running such a script in the context of the user would not permit changes to computer-specific settings.

Let me know how off-target I am with what you're asking, and I'll edit to answer your real question... (smile)

share|improve this answer
    
I think you're right on the money. Group Policy cannot cross domain boundaries, even in the same forest AFAIK. – ThatGraemeGuy Jun 4 '09 at 12:04
    
Yes Evan, you have described exactly what I am trying to accomplish! too bad I can't do it with group policy: :( – NimsDotNet Jun 5 '09 at 7:58

Evan was correct in his first sentence. Turning on the user group policy loopback processing, to "Merge", fixed this problem for me. I also had to enable "Allow cross-forest user policy and roaming user profiles".

Our situation: User in domain ABC logs on to computer in domain XYZ. I wanted user specific policies to be applied only in domain XYZ. The specific policy was to disable the shutdown/restart ability. Obviously don't want this to apply to computers in domain ABC (the users PC).

I created a new GPO in XYZ with the following settings:

  • Computer Configuration\Administrative Templates\System\Group Policy\Allow cross-forest user policy and roaming user profiles - Enabled
  • Computer Configuration\Administrative Templates\System\Group Policy\Configure user Group Policy loopback processing mode - Enabled Mode:Merge
  • User Configuration\Administrative Templates\Start Menu and Taskbar\Remove and prevent access to the Shut Down, Restart, Sleep, and Hibernate commands - Enabled
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.