Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have applied a Logon script via GPO to run BGInfo. As I understand it, as I am setting a User Configuration the GPO must be applied to a User OU. We have an OU called SERVERS which is the only OU we want this GPO to run on, however when I linked the GPO to the SERVERS OU rather than the USERS OU, the GPO was not applied. As the GPO is therefore linked to the USERS OU, it runs on every PC/SERVER in our company - which is not what we want.

If my conclusions are correct so far, I presumed that the only way I could prevent the GPO from running on any OU other than SERVERS is via a WMI Filter, however I cannot seem to create a filter that will work because I cannot access a variable such as %computername%.

I would have thought I wanted a query such as:

gwmi -namespace root\directory\LDAP -query "select * from ds_computer where DS_cn = %computername% AND ds_distinguishedName like '%ou=servers%'"

This would be the equivalent of saying "SELECT * FROM ds_Computer where DS_cn = [Current COMPUTER BEING LOGGED ON TO] AND ds_distinguishedName like '%ou=servers%'"

But this of course will not evaluate.

Am I on the right track here? Or is there a better solution?

Any advice greatly appreciated.

Many thanks dotdev

share|improve this question

2 Answers 2

up vote 3 down vote accepted

You want loopback processing. It runs "User Configuration" items assigned to a Computer's GPO as the user who logs in. So your GPO assigned to the Servers OU with configuration items for Users will run when the user logs in.

Microsoft has a better explanation in Windows Server: Understand “User Group Policy Loopback Processing Mode”

share|improve this answer
2  
+1 - It is technically possible to get the WMI filter to work but it would painfully slow to process vs. loopback. –  Ryan Ries Dec 31 '13 at 15:42
    
Hi Chris - sounds like what I need. So, I would link the GPO to the Servers OU, NOT the Users OU. And then set loopback processing to either replace or merge? –  dotdev Dec 31 '13 at 16:13
    
Yeah. That's the meat of it. –  Chris S Dec 31 '13 at 16:52
    
You need to be aware that turning on loopback processing in a single GPO enables it for any other GPO that applies to that computer. Ensure there are no user settings in the GPO's that link to locations where these computer objects reside or you could see unexpected results. Test, test, test. –  charleswj81 Jan 2 at 6:53
    
BTW, the reason the WMI method is horrible is because it performs an LDAP query for ALL computer objects in the domain and filters locally. Yikes! –  charleswj81 Jan 2 at 7:22

Avoid loopback processing; it is a troubleshooting nightmare and tends to come back and bite you sometimes years later. Instead use Group Policy Preferences (GPP) Item Level Targeting. The basic process is:

  1. Create a new GPO
  2. Browse to User Configuration | Preferences | Control Panel Settings | Schedules Tasks
  3. Create a new Scheduled Task (At least Windows 7)
  4. Configure your task to either run the script or directly launch your script
  5. On the Triggers tab, create a trigger to start "At log on"
    1. As a bonus, you can have bginfo "update" periodically by setting the "Repeat task every" option
  6. On the Common tab, check "Item-level Targeting" and open the Targeting dialog
  7. Select New Item | Organizational Unit
  8. Browse and select the OU to which you want to apply the GPP
  9. Link the GPO to the location where your user objects are located
share|improve this answer
    
thanks for your suggestion. I like the sound of this solution and will perhaps look at it next time -for now, I'll keep a bookmark of your suggestion. Thanks. –  dotdev Jan 2 at 15:15

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.