I have a farm of 2k8 R2 RDS servers which currently use loopback GPO to apply policies. The users are in a different OU to the RDS machines. The GPO's are all linked to the OU containing the servers.
There are 2 policies - TS Servers (containing the computer settings) and TS Users (containing the user settings). Loopback processing in replace mode is enabled causing the user settings to be processed from the TS Users GPO despite it being in a different OU to the users.
So far, so good.
However I now need to create a new GPO with different settings for another bunch of users. I tried this by removing Authenticated Users from the security filters applying to TS Users, and replacing with a group containing the RDS computer accounts and another containing the users.
I then created another group and GPO, linked to the same OU as the RDS machines, but security filtered so that TS Users New and TS Servers should have access.
The problem is, when I run this in GP modelling, it shows ALL of the policies above as applying. Doesn't even seem to matter if I explicitly deny the user who is logging on access to the TS User policy, it still seems to apply the settings.
Is this a bug - i.e. should I think about creating a new OU and start from scratch - or is there something else going on?