Re: Apply User Settings only when using specific Computers


"Yuppie" <xjeffx@xxxxxxxxx> wrote in message
news:1186680278.340642.95860@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
So, I am thinking the issue is all in what you mean by "specified
the scope".

Probably.

In a more normal case, one links the loopback GPO to the OU
containing the machines where this should happen.

I believe I have done this. In the GPO Settings on the Scope tab
under Security Filter "The settings in this GPO can only be applied to
the following groups, users, and computers" I have specified one
machine for testing.

Then when editing the the policy, I have changed Computer
Configuration | Administrative Templates | System/Group Policy | User
Group Policy loopback processing mode (enabled - merge) and specified
a logon script under User Configuration.

Is the the proper way to set up the GPO to accomplish what I set out
to do?


No. The computers that are to process the GPO and so see that it
is a loopback policy, and then also the user accounts that are to
have the GPO processed in loopback for them need to be in the
security group filtering.


Something seems wrong. With only the computer specified in the Scope,
the script does not run. When "Domain Users" and the computer are
specified, the script runs, but it also runs on computers other than
my test machine.


That part I do not understand. I mean, I do see how that lets the
loopback processing happen for users, but I do not see why that
cause it to apply with other computers (unless someone has
modified the membership of Domain Users). Computer accounts
are in Domain Computers and user accounts in Domain Users, so
adding Domain Users causing other computers to use the GPO
otherwise (than DU membership having been altered) does not
make sense to me.

Roger


.

Relevant Pages

  • Re: cant override screen saver policy
    ... Yes, I figured out that using loopback processing was the answer (Ok, I ... > Settings in the User Configuration part of a GPO always apply to User ... > users log on to specific computers, then enable Loopback processing in a GPO ...
    (microsoft.public.win2000.group_policy)
  • Re: Assigning and application to selected users on selected comput
    ... Microsoft Global Technical Support Center ... |> to do what you have outlined except by use of loopback processing. ... |> Then you would need to either have the loopback GPO apply to all ... |> would need to add such as Domain Computers). ...
    (microsoft.public.windows.group_policy)
  • Re: Active Directory Folders
    ... >> I'm certainly not going to discount a book published by Microsoft ... >> replace the computers and users containers created by default and ... Passowords can only be set in a GPO at the ... Laptops ...
    (microsoft.public.windows.server.active_directory)
  • Re: GPO Problems
    ... The computer configuration part belongs to computers and the user configuration part to the user, so depending on the settings you must have the accounts located there. ... If rsop.msc or gpresult /v logged on with a user account doesn't give any output there can be additional problems with GPO applying belomging to DNS confgiruration or slow links between sites. ... Only the password policy an account lockout policy have to bet set on ...
    (microsoft.public.windows.server.active_directory)
  • Re: Group policy to apply only to some workstations
    ... Gregg Hill wrote: ... the GPMC and clicked on SBSComputers, and there are no GPOs linked. ... I guess the next question would be "Why do the computers even need ... GPO) settings from applying to select computers? ...
    (microsoft.public.windows.server.sbs)