TS and Non TS working

[Guest Mike K]

Hi all,

 

I've created a new TS 2008 environment for several hundred users. The TS

side of things works really well with Group Policies and TS Profile paths

doing most of the work.

 

I now have a major problem. Users now want to use laptops in some parts of

the business. Because all the group policies are running against the users,

when they login using their usual name on to a laptop it pretty much cripples

the machine!

 

Is there a way around this i.e. loopback processing etc?

 

Any help greatly appreciated.

Mike

[Guest Vera Noest [MVP]]

Re: TS and Non TS working

 

Yes, loopback processing solves this problem.

Link the restrictive GPO to the OU which contains the TS computer

account.

 

231287 - Loopback Processing of Group Policy

http://support.microsoft.com/?kbid=231287

 

_________________________________________________________

Vera Noest

MCSE, CCEA, Microsoft MVP - Terminal Server

TS troubleshooting: http://ts.veranoest.net

___ please respond in newsgroup, NOT by private email ___

 

=?Utf-8?B?TWlrZSBL?= <MikeK@discussions.microsoft.com> wrote on 21

maj 2008 in microsoft.public.windows.terminal_services:

> Hi all,

>

> I've created a new TS 2008 environment for several hundred

> users. The TS side of things works really well with Group

> Policies and TS Profile paths doing most of the work.

>

> I now have a major problem. Users now want to use laptops in

> some parts of the business. Because all the group policies are

> running against the users, when they login using their usual

> name on to a laptop it pretty much cripples the machine!

>

> Is there a way around this i.e. loopback processing etc?

>

> Any help greatly appreciated.

> Mike

[Guest Mike K]

Re: TS and Non TS working

 

Hi Vera,

Excellent -that works nicely thanks.... the only drawback I can see is that

when I login under the Administrator account the policies are still applying

- is there any way around this other than moving the TS from the OU?

Thanks,

Mike

 

"Vera Noest [MVP]" wrote:

> Yes, loopback processing solves this problem.

> Link the restrictive GPO to the OU which contains the TS computer

> account.

>

> 231287 - Loopback Processing of Group Policy

> http://support.microsoft.com/?kbid=231287

>

> _________________________________________________________

> Vera Noest

> MCSE, CCEA, Microsoft MVP - Terminal Server

> TS troubleshooting: http://ts.veranoest.net

> ___ please respond in newsgroup, NOT by private email ___

>

> =?Utf-8?B?TWlrZSBL?= <MikeK@discussions.microsoft.com> wrote on 21

> maj 2008 in microsoft.public.windows.terminal_services:

>

> > Hi all,

> >

> > I've created a new TS 2008 environment for several hundred

> > users. The TS side of things works really well with Group

> > Policies and TS Profile paths doing most of the work.

> >

> > I now have a major problem. Users now want to use laptops in

> > some parts of the business. Because all the group policies are

> > running against the users, when they login using their usual

> > name on to a laptop it pretty much cripples the machine!

> >

> > Is there a way around this i.e. loopback processing etc?

> >

> > Any help greatly appreciated.

> > Mike

>

[Guest Kristin L. Griffin]

Re: TS and Non TS working

 

What about setting DENY for domain admins for the Advanced delegation

settings on the policy?

 

"Mike K" wrote:

> Hi Vera,

> Excellent -that works nicely thanks.... the only drawback I can see is that

> when I login under the Administrator account the policies are still applying

> - is there any way around this other than moving the TS from the OU?

> Thanks,

> Mike

>

> "Vera Noest [MVP]" wrote:

>

> > Yes, loopback processing solves this problem.

> > Link the restrictive GPO to the OU which contains the TS computer

> > account.

> >

> > 231287 - Loopback Processing of Group Policy

> > http://support.microsoft.com/?kbid=231287

> >

> > _________________________________________________________

> > Vera Noest

> > MCSE, CCEA, Microsoft MVP - Terminal Server

> > TS troubleshooting: http://ts.veranoest.net

> > ___ please respond in newsgroup, NOT by private email ___

> >

> > =?Utf-8?B?TWlrZSBL?= <MikeK@discussions.microsoft.com> wrote on 21

> > maj 2008 in microsoft.public.windows.terminal_services:

> >

> > > Hi all,

> > >

> > > I've created a new TS 2008 environment for several hundred

> > > users. The TS side of things works really well with Group

> > > Policies and TS Profile paths doing most of the work.

> > >

> > > I now have a major problem. Users now want to use laptops in

> > > some parts of the business. Because all the group policies are

> > > running against the users, when they login using their usual

> > > name on to a laptop it pretty much cripples the machine!

> > >

> > > Is there a way around this i.e. loopback processing etc?

> > >

> > > Any help greatly appreciated.

> > > Mike

> >

[Guest Vera Noest [MVP]]

Re: TS and Non TS working

 

Yes, set Deny for Apply this GPO.

 

816100 - How To Prevent Domain Group Policies from Applying to

Administrator Accounts and Selected Users in Windows Server 2003

http://support.microsoft.com/?kbid=816100

 

_________________________________________________________

Vera Noest

MCSE, CCEA, Microsoft MVP - Terminal Server

TS troubleshooting: http://ts.veranoest.net

___ please respond in newsgroup, NOT by private email ___

 

=?Utf-8?B?S3Jpc3RpbiBMLiBHcmlmZmlu?=

<KristinLGriffin@discussions.microsoft.com> wrote on 21 maj 2008

in microsoft.public.windows.terminal_services:

> What about setting DENY for domain admins for the Advanced

> delegation settings on the policy?

>

> "Mike K" wrote:

>

>> Hi Vera,

>> Excellent -that works nicely thanks.... the only drawback I can

>> see is that when I login under the Administrator account the

>> policies are still applying - is there any way around this

>> other than moving the TS from the OU? Thanks,

>> Mike

>>

>> "Vera Noest [MVP]" wrote:

>>

>> > Yes, loopback processing solves this problem.

>> > Link the restrictive GPO to the OU which contains the TS

>> > computer account.

>> >

>> > 231287 - Loopback Processing of Group Policy

>> > http://support.microsoft.com/?kbid=231287

>> >

>> > _________________________________________________________

>> > Vera Noest

>> > MCSE, CCEA, Microsoft MVP - Terminal Server

>> > TS troubleshooting: http://ts.veranoest.net

>> > ___ please respond in newsgroup, NOT by private email ___

>> >

>> > =?Utf-8?B?TWlrZSBL?= <MikeK@discussions.microsoft.com> wrote

>> > on 21 maj 2008 in microsoft.public.windows.terminal_services:

>> >

>> > > Hi all,

>> > >

>> > > I've created a new TS 2008 environment for several hundred

>> > > users. The TS side of things works really well with Group

>> > > Policies and TS Profile paths doing most of the work.

>> > >

>> > > I now have a major problem. Users now want to use laptops

>> > > in some parts of the business. Because all the group

>> > > policies are running against the users, when they login

>> > > using their usual name on to a laptop it pretty much

>> > > cripples the machine!

>> > >

>> > > Is there a way around this i.e. loopback processing etc?

>> > >

>> > > Any help greatly appreciated.

>> > > Mike

[Guest Mike K]

Re: TS and Non TS working

 

I can't find this option... am using 2008?

Thanks,

Mike

 

"Vera Noest [MVP]" wrote:

> Yes, set Deny for Apply this GPO.

>

> 816100 - How To Prevent Domain Group Policies from Applying to

> Administrator Accounts and Selected Users in Windows Server 2003

> http://support.microsoft.com/?kbid=816100

>

> _________________________________________________________

> Vera Noest

> MCSE, CCEA, Microsoft MVP - Terminal Server

> TS troubleshooting: http://ts.veranoest.net

> ___ please respond in newsgroup, NOT by private email ___

>

> =?Utf-8?B?S3Jpc3RpbiBMLiBHcmlmZmlu?=

> <KristinLGriffin@discussions.microsoft.com> wrote on 21 maj 2008

> in microsoft.public.windows.terminal_services:

>

> > What about setting DENY for domain admins for the Advanced

> > delegation settings on the policy?

> >

> > "Mike K" wrote:

> >

> >> Hi Vera,

> >> Excellent -that works nicely thanks.... the only drawback I can

> >> see is that when I login under the Administrator account the

> >> policies are still applying - is there any way around this

> >> other than moving the TS from the OU? Thanks,

> >> Mike

> >>

> >> "Vera Noest [MVP]" wrote:

> >>

> >> > Yes, loopback processing solves this problem.

> >> > Link the restrictive GPO to the OU which contains the TS

> >> > computer account.

> >> >

> >> > 231287 - Loopback Processing of Group Policy

> >> > http://support.microsoft.com/?kbid=231287

> >> >

> >> > _________________________________________________________

> >> > Vera Noest

> >> > MCSE, CCEA, Microsoft MVP - Terminal Server

> >> > TS troubleshooting: http://ts.veranoest.net

> >> > ___ please respond in newsgroup, NOT by private email ___

> >> >

> >> > =?Utf-8?B?TWlrZSBL?= <MikeK@discussions.microsoft.com> wrote

> >> > on 21 maj 2008 in microsoft.public.windows.terminal_services:

> >> >

> >> > > Hi all,

> >> > >

> >> > > I've created a new TS 2008 environment for several hundred

> >> > > users. The TS side of things works really well with Group

> >> > > Policies and TS Profile paths doing most of the work.

> >> > >

> >> > > I now have a major problem. Users now want to use laptops

> >> > > in some parts of the business. Because all the group

> >> > > policies are running against the users, when they login

> >> > > using their usual name on to a laptop it pretty much

> >> > > cripples the machine!

> >> > >

> >> > > Is there a way around this i.e. loopback processing etc?

> >> > >

> >> > > Any help greatly appreciated.

> >> > > Mike

>

[Guest Mike K]

Re: TS and Non TS working

 

Does anyone know how to do this in 2008 please?

Thanks,

Mike

 

"Mike K" wrote:

> I can't find this option... am using 2008?

> Thanks,

> Mike

>

> "Vera Noest [MVP]" wrote:

>

> > Yes, set Deny for Apply this GPO.

> >

> > 816100 - How To Prevent Domain Group Policies from Applying to

> > Administrator Accounts and Selected Users in Windows Server 2003

> > http://support.microsoft.com/?kbid=816100

> >

> > _________________________________________________________

> > Vera Noest

> > MCSE, CCEA, Microsoft MVP - Terminal Server

> > TS troubleshooting: http://ts.veranoest.net

> > ___ please respond in newsgroup, NOT by private email ___

> >

> > =?Utf-8?B?S3Jpc3RpbiBMLiBHcmlmZmlu?=

> > <KristinLGriffin@discussions.microsoft.com> wrote on 21 maj 2008

> > in microsoft.public.windows.terminal_services:

> >

> > > What about setting DENY for domain admins for the Advanced

> > > delegation settings on the policy?

> > >

> > > "Mike K" wrote:

> > >

> > >> Hi Vera,

> > >> Excellent -that works nicely thanks.... the only drawback I can

> > >> see is that when I login under the Administrator account the

> > >> policies are still applying - is there any way around this

> > >> other than moving the TS from the OU? Thanks,

> > >> Mike

> > >>

> > >> "Vera Noest [MVP]" wrote:

> > >>

> > >> > Yes, loopback processing solves this problem.

> > >> > Link the restrictive GPO to the OU which contains the TS

> > >> > computer account.

> > >> >

> > >> > 231287 - Loopback Processing of Group Policy

> > >> > http://support.microsoft.com/?kbid=231287

> > >> >

> > >> > _________________________________________________________

> > >> > Vera Noest

> > >> > MCSE, CCEA, Microsoft MVP - Terminal Server

> > >> > TS troubleshooting: http://ts.veranoest.net

> > >> > ___ please respond in newsgroup, NOT by private email ___

> > >> >

> > >> > =?Utf-8?B?TWlrZSBL?= <MikeK@discussions.microsoft.com> wrote

> > >> > on 21 maj 2008 in microsoft.public.windows.terminal_services:

> > >> >

> > >> > > Hi all,

> > >> > >

> > >> > > I've created a new TS 2008 environment for several hundred

> > >> > > users. The TS side of things works really well with Group

> > >> > > Policies and TS Profile paths doing most of the work.

> > >> > >

> > >> > > I now have a major problem. Users now want to use laptops

> > >> > > in some parts of the business. Because all the group

> > >> > > policies are running against the users, when they login

> > >> > > using their usual name on to a laptop it pretty much

> > >> > > cripples the machine!

> > >> > >

> > >> > > Is there a way around this i.e. loopback processing etc?

> > >> > >

> > >> > > Any help greatly appreciated.

> > >> > > Mike

> >