Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have my Terminal Servers (Windows 2k3) in their own OU with their own Group Policy. Loopback "merge" is enabled and everything, in general works OK.

For Computer Configuration, under Policies/Administrative Templates/Windows Components/Terminal Services/Terminal Server/Remote Session Environment I have some settings defined. In particular, "Start a program on connection" which starts the only app they need on the terminal server. Works great. When they exit the app their session ends.

However, I don't want that app to launch when I connect as a Domain Admin. In that scenario, I need the normal TS experience. I visited Delegation -> Advanced for the policy and set "Apply Group Policy" to Deny for Domain Admins. However, that only impacts the User Config, not the Computer Config (verified by gpresult) which is, upon reflected, as I'd expect (right?).

So... what's the proper way to exclude loopback processing for a user or group?

share|improve this question
add comment

2 Answers

up vote 2 down vote accepted

That is a per-computer setting, there isn't really anything you can do at the policy level to change that per user.

One thing you could do. When the admins login they should be able to specify a program to start in their terminal client. Just start explorer.exe.

share|improve this answer
    
Good thought about the work-around. Will definitely give that a shot. –  Chris_K May 16 '11 at 22:11
add comment

Could you create a new group policy and apply it to administrators, when using the loop back set that to replace? That should over write the policy.

share|improve this answer
    
An intriguing notion but I'm not entirely sure I grasp how to put that together. Can you elaborate a bit more? –  Chris_K May 17 '11 at 2:39
    
You would setup the group policy with the same loopback setting, but set that to replace. After that change Remote Session Environment > Start a program on connection, change that to Disabled. After you have that setup, remove Authenticated Users from the Security Filtering, and add Domain Administrators. Or which ever user/group you want to remove from having that setting apply. Then it should disable the startup programs for that user/group. –  Nixphoe May 17 '11 at 2:48
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.