TS and Non TS working

  • Thread starter Thread starter Mike K
  • Start date Start date
M

Mike K

Guest
Hi all,

I've created a new TS 2008 environment for several hundred users. The TS
side of things works really well with Group Policies and TS Profile paths
doing most of the work.

I now have a major problem. Users now want to use laptops in some parts of
the business. Because all the group policies are running against the users,
when they login using their usual name on to a laptop it pretty much cripples
the machine!

Is there a way around this i.e. loopback processing etc?

Any help greatly appreciated.
Mike
 
Re: TS and Non TS working

Yes, loopback processing solves this problem.
Link the restrictive GPO to the OU which contains the TS computer
account.

231287 - Loopback Processing of Group Policy
http://support.microsoft.com/?kbid=231287

_________________________________________________________
Vera Noest
MCSE, CCEA, Microsoft MVP - Terminal Server
TS troubleshooting: http://ts.veranoest.net
___ please respond in newsgroup, NOT by private email ___

=?Utf-8?B?TWlrZSBL?= <MikeK@discussions.microsoft.com> wrote on 21
maj 2008 in microsoft.public.windows.terminal_services:

> Hi all,
>
> I've created a new TS 2008 environment for several hundred
> users. The TS side of things works really well with Group
> Policies and TS Profile paths doing most of the work.
>
> I now have a major problem. Users now want to use laptops in
> some parts of the business. Because all the group policies are
> running against the users, when they login using their usual
> name on to a laptop it pretty much cripples the machine!
>
> Is there a way around this i.e. loopback processing etc?
>
> Any help greatly appreciated.
> Mike
 
Re: TS and Non TS working

Hi Vera,
Excellent -that works nicely thanks.... the only drawback I can see is that
when I login under the Administrator account the policies are still applying
- is there any way around this other than moving the TS from the OU?
Thanks,
Mike

"Vera Noest [MVP]" wrote:

> Yes, loopback processing solves this problem.
> Link the restrictive GPO to the OU which contains the TS computer
> account.
>
> 231287 - Loopback Processing of Group Policy
> http://support.microsoft.com/?kbid=231287
>
> _________________________________________________________
> Vera Noest
> MCSE, CCEA, Microsoft MVP - Terminal Server
> TS troubleshooting: http://ts.veranoest.net
> ___ please respond in newsgroup, NOT by private email ___
>
> =?Utf-8?B?TWlrZSBL?= <MikeK@discussions.microsoft.com> wrote on 21
> maj 2008 in microsoft.public.windows.terminal_services:
>
> > Hi all,
> >
> > I've created a new TS 2008 environment for several hundred
> > users. The TS side of things works really well with Group
> > Policies and TS Profile paths doing most of the work.
> >
> > I now have a major problem. Users now want to use laptops in
> > some parts of the business. Because all the group policies are
> > running against the users, when they login using their usual
> > name on to a laptop it pretty much cripples the machine!
> >
> > Is there a way around this i.e. loopback processing etc?
> >
> > Any help greatly appreciated.
> > Mike
>
 
Re: TS and Non TS working

What about setting DENY for domain admins for the Advanced delegation
settings on the policy?

"Mike K" wrote:

> Hi Vera,
> Excellent -that works nicely thanks.... the only drawback I can see is that
> when I login under the Administrator account the policies are still applying
> - is there any way around this other than moving the TS from the OU?
> Thanks,
> Mike
>
> "Vera Noest [MVP]" wrote:
>
> > Yes, loopback processing solves this problem.
> > Link the restrictive GPO to the OU which contains the TS computer
> > account.
> >
> > 231287 - Loopback Processing of Group Policy
> > http://support.microsoft.com/?kbid=231287
> >
> > _________________________________________________________
> > Vera Noest
> > MCSE, CCEA, Microsoft MVP - Terminal Server
> > TS troubleshooting: http://ts.veranoest.net
> > ___ please respond in newsgroup, NOT by private email ___
> >
> > =?Utf-8?B?TWlrZSBL?= <MikeK@discussions.microsoft.com> wrote on 21
> > maj 2008 in microsoft.public.windows.terminal_services:
> >
> > > Hi all,
> > >
> > > I've created a new TS 2008 environment for several hundred
> > > users. The TS side of things works really well with Group
> > > Policies and TS Profile paths doing most of the work.
> > >
> > > I now have a major problem. Users now want to use laptops in
> > > some parts of the business. Because all the group policies are
> > > running against the users, when they login using their usual
> > > name on to a laptop it pretty much cripples the machine!
> > >
> > > Is there a way around this i.e. loopback processing etc?
> > >
> > > Any help greatly appreciated.
> > > Mike
> >
 
Re: TS and Non TS working

Yes, set Deny for Apply this GPO.

816100 - How To Prevent Domain Group Policies from Applying to
Administrator Accounts and Selected Users in Windows Server 2003
http://support.microsoft.com/?kbid=816100

_________________________________________________________
Vera Noest
MCSE, CCEA, Microsoft MVP - Terminal Server
TS troubleshooting: http://ts.veranoest.net
___ please respond in newsgroup, NOT by private email ___

=?Utf-8?B?S3Jpc3RpbiBMLiBHcmlmZmlu?=
<KristinLGriffin@discussions.microsoft.com> wrote on 21 maj 2008
in microsoft.public.windows.terminal_services:

> What about setting DENY for domain admins for the Advanced
> delegation settings on the policy?
>
> "Mike K" wrote:
>
>> Hi Vera,
>> Excellent -that works nicely thanks.... the only drawback I can
>> see is that when I login under the Administrator account the
>> policies are still applying - is there any way around this
>> other than moving the TS from the OU? Thanks,
>> Mike
>>
>> "Vera Noest [MVP]" wrote:
>>
>> > Yes, loopback processing solves this problem.
>> > Link the restrictive GPO to the OU which contains the TS
>> > computer account.
>> >
>> > 231287 - Loopback Processing of Group Policy
>> > http://support.microsoft.com/?kbid=231287
>> >
>> > _________________________________________________________
>> > Vera Noest
>> > MCSE, CCEA, Microsoft MVP - Terminal Server
>> > TS troubleshooting: http://ts.veranoest.net
>> > ___ please respond in newsgroup, NOT by private email ___
>> >
>> > =?Utf-8?B?TWlrZSBL?= <MikeK@discussions.microsoft.com> wrote
>> > on 21 maj 2008 in microsoft.public.windows.terminal_services:
>> >
>> > > Hi all,
>> > >
>> > > I've created a new TS 2008 environment for several hundred
>> > > users. The TS side of things works really well with Group
>> > > Policies and TS Profile paths doing most of the work.
>> > >
>> > > I now have a major problem. Users now want to use laptops
>> > > in some parts of the business. Because all the group
>> > > policies are running against the users, when they login
>> > > using their usual name on to a laptop it pretty much
>> > > cripples the machine!
>> > >
>> > > Is there a way around this i.e. loopback processing etc?
>> > >
>> > > Any help greatly appreciated.
>> > > Mike
 
Re: TS and Non TS working

I can't find this option... am using 2008?
Thanks,
Mike

"Vera Noest [MVP]" wrote:

> Yes, set Deny for Apply this GPO.
>
> 816100 - How To Prevent Domain Group Policies from Applying to
> Administrator Accounts and Selected Users in Windows Server 2003
> http://support.microsoft.com/?kbid=816100
>
> _________________________________________________________
> Vera Noest
> MCSE, CCEA, Microsoft MVP - Terminal Server
> TS troubleshooting: http://ts.veranoest.net
> ___ please respond in newsgroup, NOT by private email ___
>
> =?Utf-8?B?S3Jpc3RpbiBMLiBHcmlmZmlu?=
> <KristinLGriffin@discussions.microsoft.com> wrote on 21 maj 2008
> in microsoft.public.windows.terminal_services:
>
> > What about setting DENY for domain admins for the Advanced
> > delegation settings on the policy?
> >
> > "Mike K" wrote:
> >
> >> Hi Vera,
> >> Excellent -that works nicely thanks.... the only drawback I can
> >> see is that when I login under the Administrator account the
> >> policies are still applying - is there any way around this
> >> other than moving the TS from the OU? Thanks,
> >> Mike
> >>
> >> "Vera Noest [MVP]" wrote:
> >>
> >> > Yes, loopback processing solves this problem.
> >> > Link the restrictive GPO to the OU which contains the TS
> >> > computer account.
> >> >
> >> > 231287 - Loopback Processing of Group Policy
> >> > http://support.microsoft.com/?kbid=231287
> >> >
> >> > _________________________________________________________
> >> > Vera Noest
> >> > MCSE, CCEA, Microsoft MVP - Terminal Server
> >> > TS troubleshooting: http://ts.veranoest.net
> >> > ___ please respond in newsgroup, NOT by private email ___
> >> >
> >> > =?Utf-8?B?TWlrZSBL?= <MikeK@discussions.microsoft.com> wrote
> >> > on 21 maj 2008 in microsoft.public.windows.terminal_services:
> >> >
> >> > > Hi all,
> >> > >
> >> > > I've created a new TS 2008 environment for several hundred
> >> > > users. The TS side of things works really well with Group
> >> > > Policies and TS Profile paths doing most of the work.
> >> > >
> >> > > I now have a major problem. Users now want to use laptops
> >> > > in some parts of the business. Because all the group
> >> > > policies are running against the users, when they login
> >> > > using their usual name on to a laptop it pretty much
> >> > > cripples the machine!
> >> > >
> >> > > Is there a way around this i.e. loopback processing etc?
> >> > >
> >> > > Any help greatly appreciated.
> >> > > Mike
>
 
Re: TS and Non TS working

Does anyone know how to do this in 2008 please?
Thanks,
Mike

"Mike K" wrote:

> I can't find this option... am using 2008?
> Thanks,
> Mike
>
> "Vera Noest [MVP]" wrote:
>
> > Yes, set Deny for Apply this GPO.
> >
> > 816100 - How To Prevent Domain Group Policies from Applying to
> > Administrator Accounts and Selected Users in Windows Server 2003
> > http://support.microsoft.com/?kbid=816100
> >
> > _________________________________________________________
> > Vera Noest
> > MCSE, CCEA, Microsoft MVP - Terminal Server
> > TS troubleshooting: http://ts.veranoest.net
> > ___ please respond in newsgroup, NOT by private email ___
> >
> > =?Utf-8?B?S3Jpc3RpbiBMLiBHcmlmZmlu?=
> > <KristinLGriffin@discussions.microsoft.com> wrote on 21 maj 2008
> > in microsoft.public.windows.terminal_services:
> >
> > > What about setting DENY for domain admins for the Advanced
> > > delegation settings on the policy?
> > >
> > > "Mike K" wrote:
> > >
> > >> Hi Vera,
> > >> Excellent -that works nicely thanks.... the only drawback I can
> > >> see is that when I login under the Administrator account the
> > >> policies are still applying - is there any way around this
> > >> other than moving the TS from the OU? Thanks,
> > >> Mike
> > >>
> > >> "Vera Noest [MVP]" wrote:
> > >>
> > >> > Yes, loopback processing solves this problem.
> > >> > Link the restrictive GPO to the OU which contains the TS
> > >> > computer account.
> > >> >
> > >> > 231287 - Loopback Processing of Group Policy
> > >> > http://support.microsoft.com/?kbid=231287
> > >> >
> > >> > _________________________________________________________
> > >> > Vera Noest
> > >> > MCSE, CCEA, Microsoft MVP - Terminal Server
> > >> > TS troubleshooting: http://ts.veranoest.net
> > >> > ___ please respond in newsgroup, NOT by private email ___
> > >> >
> > >> > =?Utf-8?B?TWlrZSBL?= <MikeK@discussions.microsoft.com> wrote
> > >> > on 21 maj 2008 in microsoft.public.windows.terminal_services:
> > >> >
> > >> > > Hi all,
> > >> > >
> > >> > > I've created a new TS 2008 environment for several hundred
> > >> > > users. The TS side of things works really well with Group
> > >> > > Policies and TS Profile paths doing most of the work.
> > >> > >
> > >> > > I now have a major problem. Users now want to use laptops
> > >> > > in some parts of the business. Because all the group
> > >> > > policies are running against the users, when they login
> > >> > > using their usual name on to a laptop it pretty much
> > >> > > cripples the machine!
> > >> > >
> > >> > > Is there a way around this i.e. loopback processing etc?
> > >> > >
> > >> > > Any help greatly appreciated.
> > >> > > Mike
> >
 
Back
Top