Where am I going wrong with the below?

We have a server running Server 2008 R2 which users connect to via remote desktop to run a CRM application.

This server has SQL Server 2012 installed, along with Management Studio.

Users in the Domain Admins group need access to management studio. Non-admin users should not be able to even open SQL management studio.

I have created an OU on the domain controller with this server (TSERVER) as the only object. In this OU, I have created a group policy with ssms.exe in the list of disallowed applications.

In Delegation, I have Authenticated users set to Apply Group Policy, and for Domain Admins group, I have denied Apply Group Policy.

Even after running gpupdate /force on as the Administrator on TSERVER, the policy still doesn't apply, and users can still open SQL Management Studio.

I am pretty sure it's a basic setting I'm not applying.

  • Do you have the output of gpresult or tried to find errors with rsop.msc? – curropar Feb 16 '16 at 9:48
  • Using GPResult it shows under Denied GPOs, with Empty as the reason denied. – OWSam Feb 16 '16 at 9:51
  • That is for a normal user, or a Domain Admin? – curropar Feb 16 '16 at 9:52
  • Under both Admin and regular user. – OWSam Feb 16 '16 at 9:53
  • 1
    Doh! I knew it would be something simple.... "User Group Policy loopback processing mode" Now enabled and set to Merge it works :) – OWSam Feb 16 '16 at 10:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.