2

I have applied a Logon script via GPO to run BGInfo. As I understand it, as I am setting a User Configuration the GPO must be applied to a User OU. We have an OU called SERVERS which is the only OU we want this GPO to run on, however when I linked the GPO to the SERVERS OU rather than the USERS OU, the GPO was not applied. As the GPO is therefore linked to the USERS OU, it runs on every PC/SERVER in our company - which is not what we want.

If my conclusions are correct so far, I presumed that the only way I could prevent the GPO from running on any OU other than SERVERS is via a WMI Filter, however I cannot seem to create a filter that will work because I cannot access a variable such as %computername%.

I would have thought I wanted a query such as:

gwmi -namespace root\directory\LDAP -query "select * from ds_computer where DS_cn = %computername% AND ds_distinguishedName like '%ou=servers%'"

This would be the equivalent of saying "SELECT * FROM ds_Computer where DS_cn = [Current COMPUTER BEING LOGGED ON TO] AND ds_distinguishedName like '%ou=servers%'"

But this of course will not evaluate.

Am I on the right track here? Or is there a better solution?

Any advice greatly appreciated.

Many thanks dotdev

Improve this question

2 Answers 2

Reset to default
3

You want loopback processing. It runs "User Configuration" items assigned to a Computer's GPO as the user who logs in. So your GPO assigned to the Servers OU with configuration items for Users will run when the user logs in.

Microsoft has a better explanation in Windows Server: Understand “User Group Policy Loopback Processing Mode”

Improve this answer
6
  • 2
    +1 - It is technically possible to get the WMI filter to work but it would painfully slow to process vs. loopback.
    – Ryan Ries
    Dec 31, 2013 at 15:42
  • Hi Chris - sounds like what I need. So, I would link the GPO to the Servers OU, NOT the Users OU. And then set loopback processing to either replace or merge?
    – dotdev
    Dec 31, 2013 at 16:13
  • Yeah. That's the meat of it.
    – Chris S
    Dec 31, 2013 at 16:52
  • You need to be aware that turning on loopback processing in a single GPO enables it for any other GPO that applies to that computer. Ensure there are no user settings in the GPO's that link to locations where these computer objects reside or you could see unexpected results. Test, test, test.
    – charleswj81
    Jan 2, 2014 at 6:53
  • BTW, the reason the WMI method is horrible is because it performs an LDAP query for ALL computer objects in the domain and filters locally. Yikes!
    – charleswj81
    Jan 2, 2014 at 7:22
1

Avoid loopback processing; it is a troubleshooting nightmare and tends to come back and bite you sometimes years later. Instead use Group Policy Preferences (GPP) Item Level Targeting. The basic process is:

  1. Create a new GPO
  2. Browse to User Configuration | Preferences | Control Panel Settings | Schedules Tasks
  3. Create a new Scheduled Task (At least Windows 7)
  4. Configure your task to either run the script or directly launch your script
  5. On the Triggers tab, create a trigger to start "At log on"
    1. As a bonus, you can have bginfo "update" periodically by setting the "Repeat task every" option
  6. On the Common tab, check "Item-level Targeting" and open the Targeting dialog
  7. Select New Item | Organizational Unit
  8. Browse and select the OU to which you want to apply the GPP
  9. Link the GPO to the location where your user objects are located
Improve this answer
1
  • thanks for your suggestion. I like the sound of this solution and will perhaps look at it next time -for now, I'll keep a bookmark of your suggestion. Thanks.
    – dotdev
    Jan 2, 2014 at 15:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .