3

So we have a GPO setup to redirect "My Documents" to a server location for all users in the domain (it's linked to the root "Users" OU). This works just fine, but we have 2 special workstations that numerous users login to which need to NOT inherit this policy. I understand that the folder redirection policies are user-based but I don't understand how we'd go about denying this user policy for specific computer objects in AD. As these users are moving back and forth between these "special" systems and regular systems on the network, we cannot simply exclude specific users from the root policy.

I created a loopback processing policy (set to "replace") for the OU these 2 systems reside in and linked a separate "Disable My Documents redirection" GPO to this OU, but the root-level user-based redirection policy still wins (or causes my test user account login to hang forever on "applying personal settings"). Is there a way I can override this?

Improve this question

5 Answers 5

Reset to default
1

Not exactly sure whose answer is right at this point, as it was my own fault for having a User policy in the root OU applying to all users and computer objects. I think a smart combination of Security Filtering and Inheritance/Precedence configuration could have worked around this if I had more time to test but the real fix was to move the GPO out of the root so that it no longer interferes with the policies and loopback processing on the special computers OU.

Improve this answer
4
  • Your issue was two-fold, by my guess. The first was that having the GPO to perform folder redirection at the root of your domain was causing the computer to pick up that GPO during loopback policy processing. Moving that GPO was probably the best fix (rather than doing something ugly like using "Block Inheritance"). The second issue was that, I suspect, your "Disable My Documents redirection" GPO had the various folder redirection settings set to "Not Configured". That won't "undo" another GPO higher in the GPO processing order that has folder redirection settings specified. (cont'd)
    – Evan Anderson
    Oct 21, 2010 at 1:10
  • The only way to "undo" those folder redirection settings would be to create a GPO with a "Basic" folder redirection policy for each previously-redirected folder set to "Redirect to the local userprofile location". You're really better off just moving the folder redirection GPO, as you've done, out of the path of the computer's "Replace" loopback policy processing. (How did my psychic powers do re: guessing the contents of your "Disable My Documents redirection" GPO, anyway?)
    – Evan Anderson
    Oct 21, 2010 at 1:11
  • Good call. You should mark your answer as accepted, since you found the solution.
    – Cypher
    Oct 21, 2010 at 2:35
  • Nice guess, Evan. :) But I had actually configured my "disable" policy to correctly "redirect to local userprofile" as you suggested. I think yet another issue with my configuration was that I also had that policy set to "move contents to new location" which - across a VPN on a very slow DSL connection - was very unwise! This would likely explain some login hangs I mentioned in my original request. I have since disabled that setting.
    – Matthew Flook
    Oct 21, 2010 at 17:31
1

Your comment that the root policy is winning against your test GPO, this is an issue of GPO precedence. You need to switch the precedence, or set the GPO to be enforced. To do this: in the tree listing on the left within GPMC select the OU where your policy is linked, this will display on the right a order of precedence for your GPOs which can be edited.

Improve this answer
1
  • Thanks for the suggestion. Looking at the "Group Policy Inheritance" tab for the OU containing these 2 special workstations, I see our "My Documents Redirection - Disable" policy at a precedence of 4 while the "Enable" policy is down below at number 8. In theory, this is how we want it. In practice, running GPResult on the workstations still shows that both policies are being applied, one at the computer level (disable) and the other at the user level (enable). I assume the user policy is winning because My Docs are still redirected and not changeable in the properties window.
    – Matthew Flook
    Oct 20, 2010 at 17:20
0

Apply a policy on the two machines to force only local profiles. You can find the polciy here: Computer Configuration\Administrative Templates\System\Logon\Only allow local user profiles

Improve this answer
3
  • Don't think my issue has anything to do with local vs. roaming profiles.
    – Matthew Flook
    Oct 18, 2010 at 21:30
  • Reading your question again, I think you're right.
    – edusysadmin
    Oct 20, 2010 at 1:42
  • The original question was regarding folder redirection, not roaming profiles. Don't feel bad -- a lot of people confuse the two concepts. When roaming profiles are used, it's often a good idea to use folder redirection as well, to reduce network traffic during roaming profile synchronization.
    – Jonathan J
    Feb 17, 2012 at 16:17
0

I'm not entirely positive this will work - more just theory, but couldn't you use the GPO Security Filtering for this?

The GPO is linked to the Users OU, and the Security Filtering by default applies to all Authenticated Users. So any Authenticated User within the Users OU will get this GPO applied to them.

To extend the Security Filtering a bit further, you could create a security group (let's call it Group Alpha) for all the computers that you want the policy to apply to and make all of your, as you put it, regular systems members of Group Alpha, with the exception of these two "special" systems. Then modify your GPO by adding Group Alpha to the Security Filter.

Again, just a thought - but in theory, that would cause your GPO to only apply to Authenticated Users within the Users OU using computers that are members of Group Alpha.

Of course, I could be completely misinterpreting how the Security Filter works, so you'll have to experiment. :-) And even if it does work, you'll have to make sure all your systems that you want this policy apply to are members of Group Alpha going forward.

Here's an alternative suggestion, since the above didn't work:

Is it possible to apply this GPO to the computers itself? If so, you could give Evan's suggestion a try and put the computers that you want exempted from the redirection into their own OU, and blocking inheritance on that OU. A little funky, but might work.

Improve this answer
5
  • The Security Filtering feature does seem to work in the way you describe, but for some reason not with the way our policies were laid out - I think due to the use of loopback processing in the special computer OU. Ultimately, I ended up moving the "my docs redirection" policy from the root company OU (not sure why it was there) to the Users OU so that it wouldn't ever apply down to any computer objects. Now my "redirection disable" policy appears to be working on those two systems! Thanks!
    – Matthew Flook
    Oct 21, 2010 at 0:28
  • 1
    -1 - This won't work, though you think it might. The "Loopback group policy processing" setting is a computer setting, but when the loopback processing is being performed the context of the user being logged-on is used, not the computer. As such, denying the computer the right to apply the offending policies won't help at all and you can't deny the user the rights to apply the policies or the policies won't work for that user anywhere.
    – Evan Anderson
    Oct 21, 2010 at 1:15
  • 2
    If you ever get stuck in the situation of really needing this functionality you're pretty much stuck to putting the computer into an OU marked for "Block inheritance" and applying all the various GPOs from higher-up in the domain, EXCEPT the offending GPO, to that "Block inheritance" OU. If the offending GPO is marked "No override", though, there's no way even using "Block inheritance" to accomplish what you're looking for.
    – Evan Anderson
    Oct 21, 2010 at 1:16
  • Not sure why that deserved a down-vote - I clearly noted that the suggested was hypothetical. :) Although, I don't think it will help to block inheritance on the computers, since the GPO is applied to users. Updating my answer with another suggestion.
    – Cypher
    Oct 21, 2010 at 2:29
  • @Cypher: It's nothing against you. I want to see the right answer bubbling to the top, and your answer, while clearly stated as being hypothetical, garnered an upvote that might cause other people coming to the site with a similar issue to believe that it would resolve the issue. If I could downvote w/o affecting your rep I certainly would, but that's not how the site works. Not to get too "meta", but the most important part of what I can do for questions that I don't directly answer is to upvote the right answer and downvote answers that don't work.
    – Evan Anderson
    Oct 21, 2010 at 16:01
0

I had a similar issue with a policy designed to start a program, outlook, at login. I had loopback enabled, since the policy was set to a computer ou i put it under comp\adminT\system and set the deny apply gpo permission to the admins group. It would not work. I switched it and did user\adminT\system and it processed exactly as expected.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .