2

Is there any way to specify a Group Policy only for the users who are members of a trusted active directory domain?

Improve this question

2 Answers 2

Reset to default
5

Any user policy that applies to them is going to come out of the domain their account is a member of, unless you're overriding user policy processing with loopback policy processing.

Computer policy is going to come from the domain that the computer they are logging-on to is a member of.

Are you thinking something like this? "When one of these users from domain ABC logs-on to one of the computers that is a member of domain XYZ I'd like to have certain group policy settings apply. When an ABC user logs-on to an ABC computer, though, I don't want those settings to apply. When an XYZ user logs-on to an XYZ computer, I don't want those settings to apply either."

If so, then there's no way with simple group policy to do what you're describing. You could mimic the functions of group policy with a script that checked the logon domain of the user, but running such a script in the context of the user would not permit changes to computer-specific settings.

Let me know how off-target I am with what you're asking, and I'll edit to answer your real question... (smile)

Improve this answer
2
  • I think you're right on the money. Group Policy cannot cross domain boundaries, even in the same forest AFAIK.
    – ThatGraemeGuy
    Jun 4, 2009 at 12:04
  • Yes Evan, you have described exactly what I am trying to accomplish! too bad I can't do it with group policy: :(
    – NimsDotNet
    Jun 5, 2009 at 7:58
0

Evan was correct in his first sentence. Turning on the user group policy loopback processing, to "Merge", fixed this problem for me. I also had to enable "Allow cross-forest user policy and roaming user profiles".

Our situation: User in domain ABC logs on to computer in domain XYZ. I wanted user specific policies to be applied only in domain XYZ. The specific policy was to disable the shutdown/restart ability. Obviously don't want this to apply to computers in domain ABC (the users PC).

I created a new GPO in XYZ with the following settings:

  • Computer Configuration\Administrative Templates\System\Group Policy\Allow cross-forest user policy and roaming user profiles - Enabled
  • Computer Configuration\Administrative Templates\System\Group Policy\Configure user Group Policy loopback processing mode - Enabled Mode:Merge
  • User Configuration\Administrative Templates\Start Menu and Taskbar\Remove and prevent access to the Shut Down, Restart, Sleep, and Hibernate commands - Enabled
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .