I might be asking the impossible here, as I understand it "Computer Settings" are only applied once when the computer first boots up.

What I would like to do is have different policy restrictions applied that are within Computer Settings depending upon where a user is in a particular OU. This is because this one computer acts as a Terminal Server and is used by multiple users at any one given time.

My aim here is for different Terminal Services policies to be applied with regard to sharing the clipboard and drives. I want some "powerful" users to be able to share their local drives with the terminal server, and I want other lesser users to not be able to share their local drives with the terminal server.

Is there any way I can achieve my aim?

  • can you be more specific in terms of what settings you want to manage? there might a hackish way to accomplish that. – KAPes Feb 15 '10 at 23:01
  • I want administrators to have permissions to share clipboard data, drives, etc through the RDP client to the TS. Admins are in their own OU with users inside. I want other users not to have permission to share clipboard data, drives, etc through the RDP client. Other users all have the parent OU of Staff. I have found these settings under Computer Settings -> Administration Templates -> Windows Components -> Terminal Services -> Client/Server Data Redirection. These policies are perfect, but I can only set them globally on the terminal server computer object, which is in its own OU. – tentuxius Feb 16 '10 at 22:44
  • I'm looking for the same or similar thing - you ever find an answer? If anyone knows a way to write a WMI query (or is is WQL?) to grab the logging on user's OU I think we could use WMI filter on the GPO to do it. – Jordan W. May 7 '10 at 13:47


The opposite can be done (having specific user policies always apply to the same computer regardless of which user logs on to it), but not what you're asking for here.

  • Are there any commercial security applications that would allow me to set policies in the way I want to? – tentuxius Feb 16 '10 at 19:52
  • Due to the way AD policies work, I really don't think this can be done... – Massimo Feb 16 '10 at 20:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.