Re: Group Policies for different users in TS

Hi Mike,

Set the security on the GPO so that it does not apply to the Administrators group. One way to accomplish this is to add a Deny Apply Group Policy entry to the GPO's DACL for the Administrators group.

Many people choose to put their TS servers in a separate OU and use loopback processing so that policies will only apply to users when they logon to a TS. This is distinct from your original question but I thought I would mention it.

-TP

Mike wrote:
I'm trying to configure my Citrix/TS environment with Group Policies
so that when a regular user logs in, he gets access to one set of
permissions on the server (restricted) and when an admin logs in she
gets another set of permissions (unrestricted).

Any good tips on making this happen?

Thanks,
.

Relevant Pages

  • Re: Field Support Staff Administration of AD Servers
    ... Use Restricted Groups feature of Group Policy to make them members of local ... I am looking into what it will take to give our field support staff access to our AD environment. ... I want them to have full support ability on the servers that fall into their area of responsibility above and beyond of just OU administration. ... However I do not want them to be a member of the domain administrators group because I only need them to administer a few of the servers. ...
    (microsoft.public.win2000.active_directory)
  • Re: Error 4957 trying to install SMS_MP_Control_Manager
    ... administrators group of these servers? ... This is an SMS 2003 single ... > Background Intelligent Transfer Service is not installed or running. ...
    (microsoft.public.sms.admin)
  • Re: Security loop hole? How to restrict non-admin users
    ... pack 4 and Windows 2003 servers ... The Users are not in the local administrators group or any ... other local group on the remote machine. ... >Please provide us with the current Service Pack you have ...
    (microsoft.public.win2000.active_directory)
  • Re: allow logon through terminal services
    ... We have a mixture of 2000 and 2003 servers. ... >> I have a Telecom user that needs to to be able to logon to ... >> non-server administrators from the domain administrators group. ... >> was one of the members of the domain admins group. ...
    (microsoft.public.windows.terminal_services)
  • No Domain Group shows up....
    ... ...in the local Administrators group. ... But in these servers, ... I noticed that it recognizes me as the domain admins even though D.A group ... to Administrators group, nothing but local administrator shows up. ...
    (microsoft.public.windows.server.active_directory)