I must be missing something obvious here.

We have a GPO linked to a computer OU.

The GPO runs a VB logon script (a user policy) when users log on.

I was just about to enable loopback processing on this GPO to allow it to take effect, but I realized that it was already being applied to all users who log on to the PCs in the computer OU in question.

None of the GPOs in AD currently have loopback processing enabled (I checked all of them).

Does anyone know what might be going on here?

How can a user policy

  • 1
    How do you know for sure this policy is being applied? Have you run a RSOP (RSOP.msc) to confirm which policies are actually being applied? Is there any chance the script could be initiated by something else? – john Jul 16 '13 at 11:16
  • 100% sure. Not only does linking or unlinking the GPO to the OU either cause printers to be mapped or not, but RSOP confirms the "Map printers.vbs" script runs at logon. – Austin ''Danger'' Powers Jul 16 '13 at 11:47
  • I eventually found that the GPO had been linked twice. The 2nd instance was to the OU containing all the users. Mystery solved. Thanks – Austin ''Danger'' Powers Jul 17 '13 at 20:52
  • Maybe a good idea to mark that as the answer? – john Jul 17 '13 at 21:19
  • I have marked it as the answer and have given some additional information. Hopefully this helps other people who are investigating similar Group Policy anomalies. – Austin ''Danger'' Powers Jul 18 '13 at 0:38

I eventually discovered that the GPO had been linked twice- and it was the other instance (linked to the "all users" OU) which had been applied all along.

Once I unlinked the GPO from the users OU (not shown in my screenshot), the expected behaviour (as far as requiring loopback processing to be enabled was concerned) was exhibited.

The GPO now does not apply the user settings to users logging on to PCs in the OU to which the GPO is applied- unless loopback processing is enabled. I am pleased that it now makes complete sense to me and, more importantly, unlinking the second instance of the GPO means printers are selectively mapped depending on the PC being logged on to.

Linking that GPO to a user OU would have given users the same experience irrespective of the PC they logged on to- which is not what we want as different printers are located near different groups of PCs.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.