I'm trying to apply user policies to lock down the changing of the windows theme.

However I only want this policy applied to one computer (it is a terminal server running Server 2012), let's call it ServerX.

The server in question is in an OU with other servers and I do not want to change the OU structure.

I have created a new Global Security Group named Terminal Servers and the only thing listed under security filtering for the policy is the new group Terminal Servers.

This group only has ServerX as a member.

I have made sure Authenticated Users have the read delegation privelige for the policy.

Loop back processing is turned on also for the (computer) policy, set to merge.

Now when I run gpresult on ServerX, it tells me that it applied the computer settings for this policy successfully (which would be the loopback processing) however the user settings (which are the policies to lock down the windows theme) are denied.
gpresult says: Filtering: Denied(Security) under the User policy section

I've searched around for a while and most solutions end up saying filter the policy only on Authenticated Users and use the OU hierarchy to perform the computer targeting.
However since I do not want to re-arrange the OU structure this isn't an option at this stage.

What am I doing wrong?


I took a different approach to this, figuring the only way to do it with this approach is to utilise the OU's in one way or another.

This is what I did instead:

  • Security Filter the GPO based on the target USERS rather than the single target COMPUTER. In this case my only security filter was Domain Users
  • I created a WMI filter to match the computer name of the server I am targeting: Select * from Win32_ComputerSystem where Name like "SERVERX%"

The result is that the policy is mapped to all computers that the Domain Users log in to, however it will get denied due to the WMI filter unless the name of the computer is ServerX

Basically it seems the loopback processing mode must have the users logging onto the specified computer having the 'apply this policy' delegation privilege to that policy, otherwise we get the denied error based on security filtering.

It all comes down to using this form of structure:

  • Filter computers using OU structure, then users using Security Filtering

However if the GPO is linked higher up in the hierarchy (rather than to the most specific OU which contains ONLY the affected computers) then extra filtering is needed to filter out all the exclusion computers. And I do this above via WMI filters.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.