2

This has been bugging me for a while. Here's the setup:

  • We have ~20 Win2k8r2 servers. They are separated into various OUs that I can't change. I have created a security group "DevHostsSG" that contain the computers where this policy should apply.
  • We have ~40 users. There's a specific OU "DevUsersOU" that contains a dozen users that I want to apply a policy to. I've also created a security group DevUsersSG that contains the same users.

I need a specific folder redirect GPO applied to only the users in the DevUsersOU and only on the servers in the DevHostsSG security group. The users in DevUsersOU should not have the redirect policy apply on any other servers, and no other users should have redirection when they log onto a server in the DevHostsSG security group.

My progress so far:

  • I have the loopback processing set so the redirection should apply
  • When I set the policy to the DevUsersOU and then add the DevHostsSG to security filtering (with read and apply) it doesn't work anywhere (which I'm assuming is because there aren't any computers in that OU..?)
  • When I set the policy to the domain and then use security filtering to include DevUsersSG and DevHostsSG, the policy applies even when DevUsers log into non-DevHosts
  • When I apply the group policy to only the DevHostsSG it doesn't seem to work at all (which makes me wonder if loopback processing isn't working)
  • When I create a security group that contains the specified users and computers it appears to apply to all hosts

At this point I'm running out of ideas and partly just guessing at stuff and it seems to be getting worse, for some reason I have one host in the DevHostsSG where redirect is working, two hosts where it's not working, and one host that's not in the DevHostsSG where redirect is enabled.. I've done several gpupdate /force along with logoffs and gpresult /R every time I make a change and I'm not really getting anywhere.

Any help would be greatly appreciated!

---- Further testing ----

In an attempt to simplify the situation, I've tried the following:

  • Cleared the groups in the security filters
  • Added one specific user to the security filter
  • Added one specific host to the security filter
  • Ran gpupdate on that host as that user: redirect enabled (OK)
  • Ran gpupdate on that host as another user: redirect not enabled (OK)
  • Ran gpupdate on another host as that user: redirect enabled (NOT OK)

  • Turning off loopback processing didn't make a difference

---- Responses ----

joequerty:

  1. Basically I've been running gpupdate on four hosts after each time I make a change in Group Policy Management: two hosts in the DevHostsSG group and two not in the group, and on each one I log in as a user in the DevUsersOU and as a user not in the OU.
  2. Needing a reboot sounds strange to me.. I'm just referring to the "members"/"member of" tab under AD properties (for example, in the DevHostsSG the members are DevHost1, DevHost2, etc)
  3. It would be great if the policy wasn't linked to the whole domain but I don't know what else to do
  4. That's the issue.. I can't seem to get the GPO security filter to do an "AND", the security filters always do "OR" (ie DevUser1 OR DevHost1 rather than DevUser1 AND DevHost1)

The current configuration is back to bullet 1 above, which is to have the GP apply to the DevUsersOU with the security group set to the list of hosts where the GP should apply. I've rebooted one of the hosts since the last change and folder redirection is now no longer working (it was last time I checked yesterday). When I run a gpresult /R I don't see the GP listed at all under COMPUTER SETTINGS but I do see the following under USER SETTINGS:

The following GPOs were not applied because they were filtered out
-------------------------------------------------------------------
    Local Group Policy
        Filtering:  Not Applied (Empty)

    Default Domain Policy
        Filtering:  Not Applied (Empty)

    Folder Redirect
        Filtering:  Denied (Security)

I assume that this failed because I don't explicitly include the DevUsersSG either as a separate entry in the GP security filtering section or include them in the security group that the hosts are in, but from my tests it seems that if I do either of those, the GP applies to all hosts that those users log into... So I'm pretty much back where I started..

7
  • RE: Number 2. You've added the computer accounts to a security group which you're then applying to your GPO security Filtering. In order for the computers to "know" they're in the security group and thusly apply the GPO, you need to reboot those computers
    – joeqwerty
    Commented Jan 28, 2015 at 20:41
  • Take a look at my edit about the simplification.. Seems that the security filter is ignoring the hosts listed, it's applying it to that user regardless of which host they're logging on.
    – Martin
    Commented Jan 28, 2015 at 21:02
  • Log on to one of the servers with one of the users and run the Group Policy Results wizard from the GPMC. Then look at what policies are being applied to the server and the user and which are being blocked and why. In the mean time, I'm going to go do some more research.
    – joeqwerty
    Commented Jan 28, 2015 at 21:39
  • I may have found a resolution. I've updated the original question but will verify (and have others verify) that everything's correct tomorrow. Thanks!
    – Martin
    Commented Jan 28, 2015 at 21:52
  • So the current config does not work. When I logged back in just now on a host in DevHostsSG as a user in the DevUsersOU, folder redirection was not enabled. Verified by having another user in that OU also log into one of the hosts in that security group.. I did try rebooting the host since the last changes to the GPO and security filter, no luck.
    – Martin
    Commented Jan 29, 2015 at 18:32

1 Answer 1

0
  1. Where did you run gpupdate? Loopback policy processing is a Computer Configuration setting, so in order for it to be applied to the servers in question those servers need to have Group Policy refreshed.

  2. A change to a computer account's group membership requires a reboot of that computer AFAIK.

  3. It's not recommended to use Loopback policy processing at the Domain level.

  4. If you must use it at the Domain level then make sure your security filtering has only the specific user and computer groups that you created.

I don't see any reason why Loopback policy processing in a GPO linked to the domain with the appropriate security filtering wouldn't work, but I've only ever used it on specific OU's, never at the domain level. That being said, I suspect your problem is with item number 2.

1
  • Question updated with replies
    – Martin
    Commented Jan 28, 2015 at 20:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .