How to use Group Policy

Hi,

what you'll need to do is create a new Organizational Unit and include the Terminal Users Group, which would include all the users who connect to the terminal server. You can apply this group policy to this container only, and therefore notaffecting the rest of the domain.

hope that helps,

To expand some on Answer 1:

Group Policies (GPs) can be applied only at the local computer, site, domain, and Organizational Unit (OU) level. They cannot be applied against individual users, nor can they be applied to groups (contrary to the name).

Also you can specify how to apply a GP from the default Local Security Policy snap in found under Administrative Tools.

First, at the Domain Controller (DC), create the necessary OUs (which can consist of users, groups, and computers) to allow you to apply GPs to meet your requirements.

On the Terminal Server, from the Run command, run mmc. This will create a blank Management Console. From the File menu, choose Add/Remove Snap-in. Click the Add button and choose Group Policy and click Add. In the Goup Policy Object window, click Browse and then double-click the OU you want to apply the GP against. Double-click the Policy you want to apply and then click Finish. Click Close in the Add Standalone Snap-in window. Click Close in the Add/Remove Snap-in window.

You will notice that you now have acess to many more settings than you have seen before. Usually, when you view the settings available under Local Security Policy found under Administrative Tools, all you areseeing is the Windows Settings section under Computer Configuration.

Any settings you define will only apply to that computer. If you happen to set something you shouldn't have (or mis-define a setting), don't despair. There are ways to reset the GP back to the clean default state (but that's an entirely different column).

What you need to do is to create an OU for the terminal server computer only. Then create a group policy and link it to the OU containing the terminal server. Make the necessary modifications to the group policy that you desire. At this point, the group policy should apply to all users, including your administrator ID. If not, make sure that you go into the group policy and enable "computer configuration/administrative templates/system/group policy/user group policy loopback processing mode". This will cause the policy on the terminal server OU to be applied to all users regardless of the OU in which the user resides.

Now, to make sure that the administrator ID is not impacted by the group policy. Go into AD users and computers, select the OU and right-click, then select properties, then select the group policy tab. Make sure the group policy that you've created is selected and then click on properties. When the properties comes up, select the security tab. In the security window select the domain admins group and at the bottom check the deny box for "Apply Group Policy". You'll need to logoff and back on to the terminal server box as the admin to confirm that this has taken affect.

I've tried it here and it worked.

Good luck!

The solution to what you want to do can be had from some of the other comments given. This can be done with OU's, etc. at the (AD) domain level.

What we did with Terminal Server in an NT 4 domain was to DENY Administrators (local) access to the Group Policy folder on the server. So, when an admin logged in, he couldn't get to the local policy, there by allowing him full control of the server.

Then set the local policy for regular users and they will be locked out. Some of what is neededhere are NTFS permissions (changing settings, etc.) which can be automated in Security Templates.

It isn't elegant, but it works.

Brad,

My followup to my previous reply:

I too found what you did. In my testing I created an OU and moved the Terminal Server to the OU and created the group policy for the Terminal Server OU and had apply for authenticated users and deny fordomain admins.

I, too, found that it did not work properly until I also turned on loopback processing. This was mentioned in my initial reply as well as one of my followups.

If you have the group policy on the OU with the terminal server, andhave selected the appropriate choices from within the administrative templates in the user configuration and the loopback processing in the computer configuration sections of the group policy, it should work, as it did here.

Loopback processingappeared to be the key.

I'm not sure what could be causing your problem. What you're trying to do is well documented by Microsoft and I believe that I referenced those Q articles. When we did our testing we followed the articles and it worked as advertised.