I have my Terminal Servers (Windows 2k3) in their own OU with their own Group Policy. Loopback "merge" is enabled and everything, in general works OK.
For Computer Configuration, under
Policies/Administrative Templates/Windows Components/Terminal Services/Terminal Server/Remote Session Environment I have some settings defined. In particular, "Start a program on connection" which starts the only app they need on the terminal server. Works great. When they exit the app their session ends.
However, I don't want that app to launch when I connect as a Domain Admin. In that scenario, I need the normal TS experience. I visited Delegation -> Advanced for the policy and set "Apply Group Policy" to Deny for Domain Admins. However, that only impacts the User Config, not the Computer Config (verified by gpresult) which is, upon reflected, as I'd expect (right?).
So... what's the proper way to exclude loopback processing for a user or group?