assign GPO to the terminal server only

[hjacobs]

I'm trying to assign a GPO to my terminal services server (server 2003) but I don't want administrators to be affected. Whenever I use a local policy all users are affected. Can I do this with a local policy? If not, how would I go about doing this?

thanks,

Hiroshi Jacobs

 

[intelwizrd]

if the settings you want to control are machine specific and not user specific, then im not sure that there is a way around it. I will check and see if i can dig up something.

What is it that you want to control?
Is the server a member of the domain or a DC?

 

[markdmac]

All you need to do is specify not to apply the GPO to admins. highlight your GPO in the list. Choose the Properties button then the Security tab. The last setting in the list is to Apply or Deny application of the GPO. I always make sure that admins are blocked from getting a GPO so they don't get locked out of needed tools for administration.

 

[hjacobs]

the server is part of the domain and I want to control the desktop/start menu settings of standard users that log in through terminal services.

 

[hjacobs]

highlight my gpo in what list?

 

[intelwizrd]

When you create a GPO in active directory, it has to be applied to an OU to take effect.
Open AD Users and Computers, make sure you are viewing advanced settings
Go to the OU that is linked to the GPO and right click and select properties
You should see the following tabs: General, Managed By, Object, Security, and Group Policy. Select the Group Policy Tab.
If you haven't created a GPO, you will have to do it now
Select the Policy and then click on properties.
On the window that pops up, select Security.
You may have to add/remove groups to get it to work out right but, the basic idea is to have the deny box next to apply checked for the Admin group and the allow box next to apply checked for the TS Users

Hope that helps

 

[markdmac]

You can specify Start Menu settings under the Folder Redirection section of the policy.

 

[kmcferrin]

There's two ways to apply a GPO, one is on a user level, the other is on a computer level. If you are assigning GPOs to a specific computer it will apply to all users who log into that computer, including Admins. For this reason, if you have assigned the GPO to the terminal server rather than your users (which is what it sounds like to me) then markdmac's advice will not help you.

Some policies are available to be applied to both Computers and Users, others are exclusive to one or the other. You may be able to set it to apply to the Domain Users group then mark Deny for the "Apply Group Policy" setting on the Security tab from the Properties button for Administrators. But if your policy setting is computer-only you may be stuck.

What is it that you are trying to do?

 

[hjacobs]

please see my second post regarding what I am trying to do.

remember I am using server 2003.

thanks,

 

[intelwizrd]

Also settings for the start menu/desktops can be configured under the administrative templates section, there are quite a few options and some of them are scattered around to take a look through them.

cheers

 

[intelwizrd]

A few other things to consider, when you apply the GPO to a OU make sure that the Users you want to control or a Group that users are members of are in the OU or sub OU to where the GPO is applied. Also make sure your ADM files are updated if your domain controller is not a 2003 server.

 

[hjacobs]

that may be it...my group did not have access to the OU...