Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have a batch file (logon.bat) that maps drives whenever a user logs on.

This script is applied by Group Policy to the entire domain.

Initially, this worked perfectly, as we always wanted this script to be applied. However, now we have PCs at a remote site accessing the domain via a VPN link. These PCs can take as long as 5 minutes to log on due to the combination of the drive mapping script and the slow VPN link. I experimented by removing "logon.bat" from the "Default Domain Policy" GPO, and users at the remote site could log on a few minutes faster. This is perfect- I can manually map drives at the remote site for the small number of users who need network access there.

What I then tried to do, was to create two OUs: "Main office" (where we want to continue to use the drive mapping script), and "Off-site" (for the remote site, and also laptops which are domain-joined).

The only problem is that, when I remove the reference to "logon.bat" from the "Default Domain Policy" GPO, and add it to the "Map drives at logon" GPO applied to "Main office", it no longer gets applied to the main office. I can't selectively apply drive mapping only to users at the main site.

We can't keep using an all-or-nothing approach to this logon script any more because of the performance impact it has to users working remotely.

Does anyone have any idea why the drive mapping stops working when I try to get a different GPO to handle it?

enter image description here

enter image description here

share|improve this question
add comment

4 Answers

up vote 9 down vote accepted

As mentioned, you have user policy settings being set to computer accounts. By default, this won't work.

You can get it working this way by enabling Loopback mode processing on the policy you are creating to process the settings for users logging into those computers. Loopback Processing will allow the user policy settings to be applied on a policy applied to a computer account.

Please note that enabling loopback mode will enable it on all policies in that OU applied after the policy enabling loopback mode.

share|improve this answer
    
Thanks. I'm a little surprised that user settings are only applied if you assign a GPO to a user (and likewise computer settings for a GPO assigned to computer). I had assumed that both user and computer settings would be applied to whatever user or computer the GPO was assigned to. Looks like I was completely wrong about that. So doing what I was planning (applying a user policy only to certain computers) won't be as straightforward as I thought. –  Austin ''Danger'' Powers Jul 5 '13 at 18:51
2  
It is still fairly straightfoward. Either modify the existing policy to enable loopback mode processing (computer configuration/Admin Templates/System/GroupPolicy/Loopback Policy - enable the setting and for you, probably set it to merge) or create a new policy with this setting and have the new policy applied before your drive mapping policy. –  Rex Jul 5 '13 at 18:53
    
Thanks. I found this video does a brilliant job of explaining Group Policy Loopback Processing to anyone using it for the first time: youtube.com/watch?v=2bZGMtOCXN0 –  Austin ''Danger'' Powers Jul 5 '13 at 19:04
    
If you had a GPO applied to a computer OU, and simply set loopback processing to "replace" mode (but didn't actually define any user settings in that GPO so it didn't actually conflict with any user settings), would it still prevent all user settings (defined by other GPOs and applied to users logging on to this computer) from being applied? –  Austin ''Danger'' Powers Jul 5 '13 at 21:19
1  
If you set the policy mode to "replace", it will drop user policy settings that have been applied in a different OU with any user policy settings defined in policy objects applied in the current OU after the loopback policy is applied. Meaning, if you have a second policy object in the computer OU with user settings that is applied after the policy that enables the loopback policy in replace mode, those settings will still be applied. However, any policy settings from a user OU will not be applied. –  Rex Jul 5 '13 at 21:45
show 1 more comment

You have a user policy being bound to a computer OU. The settings need to match up to the contents of the OU they are bound to.

share|improve this answer
    
So, conversely, if I have a GPO with computer policies applied to a user OU, the computer policies will not be applied either? –  Austin ''Danger'' Powers Jul 5 '13 at 21:12
1  
@Austin Correct. If a policy has both elements it needs to be applied to where object type exists. The only exception is loopback processing as Rex mentions. –  Tim Brigham Jul 6 '13 at 17:42
    
Good to know. Most of our GPOs so far have been applied at the domain level, so we never had to consider that before. Thanks for clarifying. –  Austin ''Danger'' Powers Jul 6 '13 at 18:39
add comment

A logon script is a user policy. It won't apply to computers that you put in that OU, because it applies to users.

share|improve this answer
add comment

As other answers have stated, user policies don't apply to computers, but you can use loopback processing mode to allow this.

How much bandwidth do you have between the sites, and how many users/computers are at the remote site?

I suspect the delays you are seeing aren't due to the policies you are applying, but actually because you are mapping network drives over a slow WAN link.


I can't tell from the detail in your question, but if you haven't already, you'd see a big improvement if you installed a domain controller at your remote site, configured an AD site & subnet, and set up DFSR to replicate your network shares between the two sites.

We've been running a similar set up since around 2006, replicating around 500GB of data between two file servers with a bandwidth of no more than a theoretical maximum of 384Kbps. Depending on how much data/bandwidth you have, I'd recommend kicking off the initial replication with the remote site server located at the main office, otherwise you could be waiting a long time for the initial sync to complete.

share|improve this answer
    
I would love to setup another server, but it's a non-profit organization with a tight budget, and I don't think they could justify the expense... especially considering this already works very well (apart from the delayed logon). I am excited to test out GP loopback processing tonight (probably going for "merge" rather than "replace") as this looks like it could solve the last problem they have with this configuration. –  Austin ''Danger'' Powers Jul 5 '13 at 20:29
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.