Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

What I am trying to achieve

We use centralised printing in one office only, so I need to ensure that in this office the relevant network printers exist when a user logs on to a Terminal Server, as well as preventing any local printers from being redirected


The problem

I have 2x GPO's that I wish to only apply when the user logging on to any of our Terminal Servers in a specific OU is in a certain security group. I've added that group via Security Filtering, however the GPO's are not being applied, with GP Modeling saying `Access Denied (Security Filtering).

According to TechNet though, that should not be the case -

If the computer account or user account does not meet the security filtering criteria, the entire GPO will be denied at that client.

My understanding of the above is that a user account meets the security filtering criteria (i.e. the user is a member of the security group specified), so the GPO should not be denied.


The settings that I am trying to apply

Here is a step by step of what I am currently doing. The GPO's are to be applied every time a user logs on to a Terminal Server in the OU DD Terminal Servers.

The first policy should apply these settings -

  • Computer -
    • Administrative Templates\System\Group Policy -
      • Group policy slow link detection (Disabled)
      • Scripts policy processing (Enabled, Disabled, Enabled)
      • User Group Policy loopback processing mode (Replace)
  • User -
    • Windows Settings\Scripts\Logon
      • a script called add_network_printers.vbs

The second policy should apply this setting (in retrospect, it can be rolled in to the above policy, as it should affect the same users) -

  • Computer -
    • Administrative Templates\Windows Components/Terminal Services/Client/Server data redirection -
      • Do not allow client printer redirection (Enabled)

Images

Here are images showing the GPO permissions and the group memberships of a relevant test user. Please note that I have ensured the object DD\Sherborne has the Apply Group Policy permission, even though it is not shown here -

enter image description here enter image description here

Please can someone help me understand why these GPO's are being denied. Thanks.

share|improve this question
    
Assuming you followed that Technet article and verified that the security group has read and Apply permissions, is the GPO applying user settings or computer settings? –  TheCleaner Oct 8 '13 at 14:27
    
You'll need to post the permissions set on the GPOs and the group membership of the test user in order for us to tell you anything useful. –  Evan Anderson Oct 8 '13 at 14:28
    
@TheCleaner - The GPO is being denied for both Computer and User policies. And yes, I ensured that the security group had the Read and Apply Group Policy permissions, but still no joy. –  David Gard Oct 8 '13 at 14:43
    
Are you using loopback 'merge' policies? If so, I believe the Computer account must be able to read the policy, too. I.e., add the computer security group (Or Domain Computers) to the GPO and see where you get to. –  Dan Oct 8 '13 at 15:01
    
@EvanAnderson - I have updated my question with the information you requested. Please let me know if you wish to see more. –  David Gard Oct 8 '13 at 15:02

2 Answers 2

up vote 1 down vote accepted

The second policy should apply this setting (in retrospect, it can be rolled in to the above policy, as it should affect the same users) -

Computer - Administrative Templates\Windows Components/Terminal Services/Client/Server data redirection - Do not allow client printer redirection (Enabled)

This is a core issue with your solution. The above policy is a machine wide configuration - it can not be applied on a per user basis. You can either configure a Terminal Server with this configured, or not. There's no in-between with the policy you've chosen.

Secondly, the first policy (The Loopback Stuff and the vbs script) should be two separate policies.

The first should ONLY contain the computer configuration stuff and should, ideally, be applied to "Authenticated Users" or, at the very least, the Terminal Server accounts/groups.

The second policy will be your User Configuration settings, and should only apply to the users who you want to have that printer.

share|improve this answer
    
Ok, so I've taken your advise and split the first policy in to two. I've not got this working, with Authenticated Users able to apply the computer settings. However, rather than apply the user setting to my desired group only (it still applied to everyone) I had to again give access to Authenticated Users and then deny the Apply Group Policy privilege to users not in a specific group. It's not ideal, as it's harder to maintain, but it works for now. –  David Gard Oct 9 '13 at 9:43
    
And for the second policy - Can I assume that in your experience it is not at all possible for some users to redirect printers, and some to not? –  David Gard Oct 9 '13 at 9:45
    
This article may help you (Bottom section) - technet.microsoft.com/en-us/library/ff519145(WS.10).aspx –  Dan Oct 9 '13 at 9:49
    
I was aware you could do that locally, and that is what annoys me about MS - they let you define when you log on to a TS what resources you want to take (per user), but seemingly through GPO it's per computer, which makes no sense! Thanks. –  David Gard Oct 9 '13 at 10:28

I don't see how this could work. You need the machine to process the Computer Configuration settings in order for Loopback Policy processing to occur so that your User Configuration settings are applied to the users in the Security Group when they log onto this machine, but you've denied the machine the permissions needed to read and apply the Group Policy object. You're in a bit of a catch-22. You'll need to set the Security Filtering to allow the machine to read and apply this GPO.

See here:

http://blogs.technet.com/b/askds/archive/2013/05/21/back-to-the-loopback-troubleshooting-group-policy-loopback-processing-part-2.aspx

share|improve this answer
    
Thanks for the link. I've dealt with GPO for years but never this aspect of it, so it's always good to have more information to draw upon. –  David Gard Oct 9 '13 at 9:47

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.