Re: Can I permission a GPO to an univesal group ?
From: William P (WilliamP_at_discussions.microsoft.com)
Date: 03/14/05
- Next message: WBailey: "Novell Client or MS Client for Netware on TS 2003 ?"
- Previous message: Bertrand: "Re: cannot empty the clipboard"
- In reply to: George: "Re: Can I permission a GPO to an univesal group ?"
- Messages sorted by: [ date ] [ thread ]
Date: Mon, 14 Mar 2005 00:01:01 -0800
George,
As long as there is a trust within the domains (assuming they are in the
same forest), you can add Users from different child domains to the Universal
group. The se
In the security filter of the GPO, check to make sure the READ and APPLY
GROUP POLICY are set to 'Allow' for your Universal group, otherwise the
Loopback won't apply. Also, make sure the computer itself is receiving the
policy by checking the secuirty filter to make sure the Computer Account is
in a group which also has READ and APPLY GROUP POLICY are set to 'Allow'.
Check your event log also for errors.
"George" wrote:
> William, please excuse me for not put the question complete.
> Actually , my question is I have a GPO ( for server lockdown) that link to
> an OU where I have a terminal server. This terminal server , while siting in
> our domain OU , will be access by differnt domain users within the same
> forest.
> Someone set the security filtering is to permission a universal group and
> seems like the GP does not apply to other domain users within that Universal
> group.
>
> Setting the Loopback Mode doesn't help to solve the problem as the main
> point is how can I enforce a GPO to a terminal server which will be accessed
> by user from different domain ?
>
> George
>
> "William P" <WilliamP@discussions.microsoft.com> wrote in message
> news:3FC69047-C83F-4769-AD58-43D68357AE45@microsoft.com...
> >I assume you mean modifying the security filter on a GPO to contain a
> > Universal group. Why not just create a Domain Local group. Then you can
> > add
> > global groups and domain local groups from other domains within your
> > forest
> > to this group.
> >
> > Depending upon how large your network is and replication latency within
> > and
> > how often the members of the groups change, I suggest Domain Local over
> > universal.
> >
> > William P.
> >
> > "George" wrote:
> >
> >> Hi, Can I permission a GPO to an univesal group ( that consists of
> >> members
> >> in other domain in the same forest )? If not , is there any workaround ?
> >> I
> >> only have permission in our domain and I can not link our GPO to other
> >> domain.
> >>
> >> George
> >>
> >>
> >>
> >>
> >>
>
>
>
- Next message: WBailey: "Novell Client or MS Client for Netware on TS 2003 ?"
- Previous message: Bertrand: "Re: cannot empty the clipboard"
- In reply to: George: "Re: Can I permission a GPO to an univesal group ?"
- Messages sorted by: [ date ] [ thread ]
Relevant Pages
|
