I'm trying to apply user policies to lock down the changing of the windows theme.
However I only want this policy applied to one computer (it is a terminal server running Server 2012), let's call it ServerX
.
The server in question is in an OU with other servers and I do not want to change the OU structure.
I have created a new Global Security Group
named Terminal Servers
and the only thing listed under security filtering for the policy is the new group Terminal Servers
.
This group only has ServerX
as a member.
I have made sure Authenticated Users
have the read delegation privelige for the policy.
Loop back processing
is turned on also for the (computer) policy, set to merge
.
Now when I run gpresult
on ServerX, it tells me that it applied the computer settings for this policy successfully (which would be the loopback processing) however the user settings (which are the policies to lock down the windows theme) are denied.
gpresult
says: Filtering: Denied(Security)
under the User policy section
I've searched around for a while and most solutions end up saying filter the policy only on Authenticated Users and use the OU hierarchy to perform the computer targeting.
However since I do not want to re-arrange the OU structure this isn't an option at this stage.
What am I doing wrong?