1

I am wanting to restrict a GPO to all users signing into a terminal server.

Do I just define the terminal server computer object as the scope and then exclude my admin users from having that GPO applied.

Sadly the object is in an OU with many other servers and moving it out isn't an option due to other GPs. (don't ask)

So is just creating a new GP and only applying it to that one computer object enough for it to only apply to users signing into that object?

Improve this question
4

You cannot use a security filter to only apply a GPO to a terminal server. This will cause only the computer configuration policy to get processed, user configuration will not get applied since the user is not included in the policy filter. The correct why is to use a WMI filter like the following:

Select * From Win32_ComputerSystem Where Name = "ComputerName"
Improve this answer
  • Hi @Joe, thanks for that. If I apply the same GPO to the security group through which users sign into the terminal server will it also apply the same settings to their local machines? I only want this GP to like hide control panel stuff on the terminal server, not also their local machines. – user757392 Feb 4 '19 at 17:58
  • I get this when I try that: --------------------------- Warning --------------------------- Either the namespace entered is not a valid namespace on the local computer or you do not have access to this namespace on this computer. It is possible this is a valid namespace on the remote computer(s). If you wish to use this namespace, press OK. Press cancel to choose another namespace. --------------------------- OK Cancel --------------------------- – user757392 Feb 4 '19 at 18:00
  • Hi @Joe So, if I would only select computer objects in the scope then settings would only apply to those computers? I'm wanting to do the same thing in a different GP and restrict to only 5 servers and I want any user logged into that server to have the same windows update setting. Would that work? – user757392 Feb 5 '19 at 13:56
  • (why can't I tag people anymore using the @ tag? Previously in Edge I would have people's nicknames appear if I'd type @username but they no longer do?) – user757392 Feb 5 '19 at 13:57
  • I've tested this now and it does seem to work as expected, thank you so much @Joe! – user757392 Feb 5 '19 at 13:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.