2

We have a logon-script that copies a number of remoteapp.rdp-files to some users desktops. However these users sometimes also has to connect directly to our terminal server through a remote desktop connection to use certain software. When they connect to to the remote desktop we don't want the remoteapp.rdp-files to be copied there.The specific users are all members of an AD security group. Then we have an OU with all of the organizations client computers.

So what I would like to do is apply a GPO with the logon-script to the users within the AD user group if they log on to a client computer within the client OU. The GPO and logon-script are user-specific.

I created a GPO that applies to the user AD group and that is linked to the client computer OU. This doesn't seem to work, no files are copied at least. I think the problem might be that the GPO settings are user-specific while the linked OU only contains computers. Any suggestions on a different approach that will make the GPO work as intended?

  • Hi, welcome to SF. Please indicate what you have tried yourself so far, or with what you're haven problems, specifically. – Felix Frank Aug 7 '14 at 10:38
  • I edited my answer to explain why it would be more suitable in your situation than using Loopback Processing. – I say Reinstate Monica Aug 8 '14 at 20:11
2
  1. Create a WMI filter that returns TRUE when run on any machine other than your Terminal Server: SELECT * FROM Win32_ComputerSystem WHERE NAME <> 'COMPUTER_NAME_HERE'
  2. Create a GPO just for your file-copying logon script and apply the WMI filter to the GPO.
  3. Replace the GPO's default Authenticated Users group in Security Filtering with the security group containing your targeted users.
  4. Link the GPO to the OU that contains the user accounts to be affected.

This will cause the GPO to run when the targeted users logon any computer in the domain except your Terminal Server.

This approach doesn't introduce the typical unintended side-effects so common with Loopback Processing. In your case, if you use Loopback Processing, every user (not just the members of your AD Security Group) will have all of their user GP settings applied when they log into your Terminal Server, turning your efforts to apply only the file-copying setting into a situation where unrelated settings are applied to unrelated users.

  • This worked like a charm! Great solution to filter out some computers not to be affected of the GPO. Thanks a lot for the help! :D – Chobom Aug 11 '14 at 5:36
  • Glad it helped. You can do a lot with WMI filters to ensure GPO settings are only applied when you want them to be. They're worth spending time getting used to their capability. – I say Reinstate Monica Aug 11 '14 at 14:22
2

You're looking for Group Policy Loopback Processing. This ensures that the User Settings of a policy applied to a computer is applied to the user account logging on, even if that policy does not directly apply to the user account in question.

Combine this with security filtering to ensure that only the members of the AD group that you want to get the settings will apply the GPO, and you should be good to go.

  • Beat me to the punch with Loopback Processing. Basically, this is the type of functionality Loopback Processing was specifically built for. Note that there are two different modes:{Merge and Replace} in Loopback Processing. In your particular instance, it seems like a replace mode Loopback Processing GPO is in order. – Get-HomeByFiveOClock Aug 8 '14 at 14:38
  • I tried to apply Loopback Processing to my GPO, I never got it to work for me though :/ However it sounds like it should do the job. Thanks for the input :) – Chobom Aug 11 '14 at 5:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.