We are trying to figure out how to have a computer policy apply for only users in a specific security group. Essentially we have a group of users where we want to lock down things like server manager and powershell, but other users should have access to them on this remote desktop server. The RDP server is in its own OU with the group policy applied. In the group policy we updated the scope to only include the security group of the users we want the computer policy applied to. We also ensured under the delegation tab that authorized users had read access to the group policy.

When we run the group policy modeling wizard group policy is not applied because of security filtering. If we remove the security filtering and just have authenticated users, the group policy is applied ... for all users as you would expect.

Thanks in advance for your help!


Other Details Windows 2008 R2 Domain and Windows 2012 R2 RDP Server

  • Can I ask what setting you set ? as usually you can block/allow user with user configuration setting – yagmoth555 Mar 16 '17 at 22:25

You can't filter Computer Configuration settings in a GPO based on a security group that contains users as members. Computer Configuration settings apply to computers, User Configuration settings apply to users, and never the twain shall meet.

The reason it works for Authenticated Users is because all computer accounts are members of Authenticated Users.


In addition to joeqwerty's answer, if you need to do it and can change your setting from computer to user, then;

You could use loopback processing mode.

Using Group Policy Management Console, edit the GPO you desire, expand Computer Configuration\Policies\Administrative Templates\System\Group Policy, and then double-click User Group Policy Loopback Processing Mode.

Then select the appropriate option (Replace or Merge).

A small explanation there

A workaround is to use user configuration settings with your security group filter with a WMI filter to target only that specific server.

Select * From Win32_TerminalServiceSetting Where TerminalServerMode=1
  • Loopback policy processing allows you to apply different User Configuration settings based on the computer that the user is logging onto. It does not allow you to apply different Computer Configuration settings based on the user that is logging in. – joeqwerty Mar 16 '17 at 20:18
  • @joeqwerty ah, my bad, badly read the Q. I will keep my answer as a addition to yours then – yagmoth555 Mar 16 '17 at 22:21
  • 1
    It took me a minute to grasp the question too. As always, you're top-notch! – joeqwerty Mar 16 '17 at 22:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.