Re: OU GPO - Problem setting TS Profile Path for users under a specifi

You are configuring settings under Computer Configuration in a GPO
which is linked to an OU which contains user accounts. These
settings will never be applied.
Computer Configuration settings are applied to computers, not
users, and vice versa. That's also the reason that your starting
application isn't applied when defined as a Computer Configuration
setting. The fact that the desktop isn't displayed in the
background of the starting application is the whole idea with this
setting. It's considered a feature.

I think that you have misunderstood the functionality of the
loopback processing setting of the GPO linked to the OU which
contains the Terminal Server machine account.
It causes all settings, both Computer and User Configurations, to
be taken from any GPOs applied to the TS-OU, not from the Users-OU.

So you'll have to redesign your GPOs. TS settings go into the TS-
GPO, settings which should apply to your users when they logon to
their workstation go into the Users-GPO.

231287 - Loopback Processing of Group Policy
http://support.microsoft.com/?kbid=231287

Note that you can accomplish different settings for different user
groups by using security filtering of the GPOs:

816100 - How To Prevent Domain Group Policies from Applying to
Administrator Accounts and Selected Users in Windows Server 2003
http://support.microsoft.com/?kbid=816100

_________________________________________________________
Vera Noest
MCSE, CCEA, Microsoft MVP - Terminal Server
TS troubleshooting: http://ts.veranoest.net
___ please respond in newsgroup, NOT by private email ___

=?Utf-8?B?ZHVkZURhZA==?= <dudeDad@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote
on 26 apr 2008 in microsoft.public.windows.terminal_services:

Here is what I am trying to accomplish:

I have 3 different OUs : OU1, OU2, OU3 each with its own set of
users. I want all users in OU1 to use the same Mandatory
Profile. I want all users in OU2 to use a mandatory profile
that is configured just for OU2, ...etc...

I try to accomplish this by using a GPO at the OU level to set
the TS Roaming profile. Unfortunately, it is not working.
When i log in for the first time with one of the child users, it
just creates a local account off the default user.

Here is the setup:

Each of these OUs has several user account defined under them:
OU1 --> User11, User12, User13
OU2 --> User21, User22, User23
OU3 --> User31, User32, User33

Each OU gets a unique Mandatory Profile Path that each of its
child users will use

OU1 --> \\ts\Profiles\User1Series
OU2 --\\ts\Profiles\User2Series
OU3 --> \\TS\Profiles\User3Series

I set up a GPO on the OU and properly configure Computer
Configurations\AdminTemplates\WindowsComponants\TermServices\Set
Path for TS Roaming Profile

I properly share the Profiles Directory

I had followed the proper procedures to create a mandatory
profile ( MyComputer/Manager\Advance\Users\Copy To & Permission
Everyone and then change ntuser.dat to ntuser.MAN

The TS is in its own OU with a GPO that has LoopBack processing
turned on (Merge)

All of this and yet it does not work as expected. What happens
is that each time one of the users logs it, it goes ahead and
creates a profile based on the default user.

Any thoughts?

Another strange (related?) thing.... I set the OU GPO also to
start a specific application when the conneciton is made. When
I do this using the /Computer
Setting/AdminTemp/Windowscomponants/Start Program on connection
... it doesn't do it! However, if I also make the same
configuration under User Configurations it does start the
program (full screen) but does not show any desktop behind it!
Strange!
.

Relevant Pages

  • Re: GP Policy setup
    ... Deploying software via GPO ... I figured out that there were two settings. ... You configure the User Configuration side of things to ... >> OU in which the user account object directly resides. ...
    (microsoft.public.win2000.group_policy)
  • Re: Proxy Settings
    ... A GPO is logically made up of two sections - Computer Configuration and User ... Settings under User Configuration affect user accounts the ...
    (microsoft.public.win2000.active_directory)
  • Re: GPO not taking affect
    ... A GPO is logically made up of two sections - Computer Configuration and User ... Settings under User Configuration affect user accounts the ...
    (microsoft.public.win2000.group_policy)
  • Re: Complex GPO Configuration Issue
    ... The user settings are definitely enabled on the policy in question. ... pushing GPO to do something it was never intended to do. ... > Loopback processing is computer configuration. ...
    (microsoft.public.windows.group_policy)
  • Re: Will "Computer Configuration" policies that are applied at the OU level get passed dow
    ... > I have an OU called Florida that contains all of my users in Florida. ... > attach a Group Policy to this OU that contains Computer Configuration ... > settings, ... you'll need to link a GPO to the OU where your computer accounts ...
    (microsoft.public.win2000.group_policy)