Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Running Windows Server 2008 Service Pack 2 with Remote Desktop Services role. I want to hide the servers drives using a GPO, but not the users local drives when they are logged on to their local system.

Using a GPO, I went to "User Configuration - Policies - Administrative Template - Windows Components - Windows Explorer" and enabled "Hide these specified drives in My Computer" and "Prevent access to drives from My Computer" and in both used "Restrict all drives". Then under "Security Filtering" for the GPO, I restricted it to the system running Remote Desktop Services and the specific users who will be using RDS.

I then applied the GPO to our domain and it worked a little too well. Not only was I successful in getting the GPO to work for RDS users, but it also affected those same users at their local systems as well.

I've tried everything I can think of, but can't figure out how to apply this just to the RDS but not at their local system. What am I missing?

share|improve this question
add comment

1 Answer 1

up vote 7 down vote accepted

You need to use Loopback Policy processing. Move the RDS server to a new OU. Link your "drive restriction" GPO to this OU. Configure Loopback Policy processing in this GPO to Replace or Merge mode (depending on whether you want to replace the users normal GPO settings with these GPO settings or merge the users normal GPO settings with these settings). I suspect you'll want Merge mode.

Now when a user logs on to the RDS server the User Configuration settings from the GPO linked to this OU will apply in addition to or in replacement of the users normal GPO settings. This way the drive restriction is only effective when logging on to the RDS server and not on their workstations.

share|improve this answer
1  
Congrats on 50k! Beat me by 80 :) –  Shane Madden Oct 24 '12 at 22:27
    
Thanks much. My answer to reputation ratio is a bit embarrasing but as they say: Even a medical student who graduates last in his/her class is called Doctor... ;) –  joeqwerty Oct 24 '12 at 22:30
    
Thanks, that worked. I had tried that before but I guess I did something wrong that time. –  Kevin Murray Oct 24 '12 at 22:33
    
Glad to help... –  joeqwerty Oct 24 '12 at 22:37
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.