Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to apply user policies to lock down the changing of the windows theme.

However I only want this policy applied to one computer (it is a terminal server running Server 2012), let's call it ServerX.

The server in question is in an OU with other servers and I do not want to change the OU structure.

I have created a new Global Security Group named Terminal Servers and the only thing listed under security filtering for the policy is the new group Terminal Servers.

This group only has ServerX as a member.

I have made sure Authenticated Users have the read delegation privelige for the policy.

Loop back processing is turned on also for the (computer) policy, set to merge.

Now when I run gpresult on ServerX, it tells me that it applied the computer settings for this policy successfully (which would be the loopback processing) however the user settings (which are the policies to lock down the windows theme) are denied.
gpresult says: Filtering: Denied(Security) under the User policy section

I've searched around for a while and most solutions end up saying filter the policy only on Authenticated Users and use the OU hierarchy to perform the computer targeting.
However since I do not want to re-arrange the OU structure this isn't an option at this stage.

What am I doing wrong?

share|improve this question
up vote 0 down vote accepted

I took a different approach to this, figuring the only way to do it with this approach is to utilise the OU's in one way or another.

This is what I did instead:

  • Security Filter the GPO based on the target USERS rather than the single target COMPUTER. In this case my only security filter was Domain Users
  • I created a WMI filter to match the computer name of the server I am targeting: Select * from Win32_ComputerSystem where Name like "SERVERX%"

The result is that the policy is mapped to all computers that the Domain Users log in to, however it will get denied due to the WMI filter unless the name of the computer is ServerX

Basically it seems the loopback processing mode must have the users logging onto the specified computer having the 'apply this policy' delegation privilege to that policy, otherwise we get the denied error based on security filtering.

It all comes down to using this form of structure:

  • Filter computers using OU structure, then users using Security Filtering

However if the GPO is linked higher up in the hierarchy (rather than to the most specific OU which contains ONLY the affected computers) then extra filtering is needed to filter out all the exclusion computers. And I do this above via WMI filters.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.