I'm trying to apply user policies to lock down the changing of the windows theme.
However I only want this policy applied to one computer (it is a terminal server running Server 2012), let's call it
The server in question is in an OU with other servers and I do not want to change the OU structure.
I have created a new
Global Security Group named
Terminal Servers and the only thing listed under security filtering for the policy is the new group
This group only has
ServerX as a member.
I have made sure
Authenticated Users have the read delegation privelige for the policy.
Loop back processing is turned on also for the (computer) policy, set to
Now when I run
gpresult on ServerX, it tells me that it applied the computer settings for this policy successfully (which would be the loopback processing) however the user settings (which are the policies to lock down the windows theme) are denied.
Filtering: Denied(Security) under the User policy section
I've searched around for a while and most solutions end up saying filter the policy only on Authenticated Users and use the OU hierarchy to perform the computer targeting.
However since I do not want to re-arrange the OU structure this isn't an option at this stage.
What am I doing wrong?