2

I've had our AD setup running on server 2008r2 and now 2012, and I swear, a user policy applied to an OU containing only computers actually does apply to users logging into those computers, without loopback processing enabled. Everything I read seems to say that is not how it should work, but it does. Is this normal behavior?

Just tested again - created a policy with a drive map (which is a user policy), applied it to an OU containing my terminal server, forced a gpupdate, logged out/in, and sure enough, the drive is mapped. I did NOT turn on loopback processing.

1
  • 1
    Use RSoP to see what policies are applied. Just because you didn't turn on loopback in your GPO doesn't mean it wasn't turned on at all. RSoP will show you the combined effect of all policies for a specific user on a specific computer. Jul 3, 2013 at 11:06

1 Answer 1

3

AFAIR Yes, this is required.

Note that loopback processing can be enabled in any GPO. So, even though you did not enable it in your drive map GPO, it might've been enabled elswhere.

Run GPResult /h in an administrative cmd on that machine to confirm that loopback processing is enabled (note that only the first GPO where loopback processing gets enabled may be displayed).

You might've already stumbled across it, but this technet blog article is a good read and might be useful to you.

2
  • +1 A GPResult is the only answer here - everything else would be just speculation.
    – Dan
    Jul 3, 2013 at 8:21
  • Ding ding ding! Thanks for that. Everything I read never mentioned that loopback was not specific to each policy object so I just assumed it was. So yes I had it enabled in multiple policies applied to that OU already. Thanks! Jul 3, 2013 at 14:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .