1

I have a rather complex setup in mind, and I am quite new to Active Directory. I want to configure group policy loopback processing so that: Certain users (in different OUs), on certain computers (either in an OU or in a security group, not sure yet) can have some different user policies.

I think that I want to do a merge loopback, since I want to keep most of the user configurations and override others, but am having trouble implementing it. So far, in my test environment, here is my setup that isn't working (I am testing with desktop shortcuts):

An OU called Computers 1 with Computer 1 in it. A security group called Managed Users.

A GPO attached to OU Computers 1 with security filtering for Managed Users group. This GPO has loopback processing in Merge mode, and in User Configuration has a shortcut to Control Panel.

A GPO attached domain-wide with security filtering for Managed Users. It adds a shortcut for AppWiz.

Currently, when logging in with a user in Managed Users, only the Control Panel shortcut appears, which means that something is wrong with my loopback policy. Any help would be greatly appreciated. Thank you.

Also, in the future I will most likely have two policies for the Computer OU, the one that is already there and then another one to apply to users not in the Managed Users group.

2 Answers 2

0

Loopback Policy Processing is a Computer Configuration setting. In order for the computer to apply the policy so that the loopback user settings can be applied to the user, the computer account has to be a member of the security group that you're filtering on. Otherwise the computer will not be able to apply the GPO and therefore your loopback settings will not apply to the user.

0

A GPO attached domain-wide with security filtering for Managed Users. It adds a shortcut for AppWiz.

If this GPO is linked at the top level of the domain, and you are using Merge loopback policy processing mode, you don't need loopback processing for those settings that apply to the Managed Users.

A GPO attached to OU Computers 1 with security filtering for Managed Users group.

You shouldn't change the security filtering. Leave it applying to Authenticated Users, which will include the computers and users that the policy should apply to.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .