Terminal and PC logons

[Kazhbu]

I have user who log on mainly through terminals, and those have their rights severly limited. Sometime users who are in the terminal services group will log onto the domain with a PC. Then I need them to have more freedom on that PC. Is there a way to tell the DC that when someone has logged on with a computer that has an account in this domain, use this policy, and when they log on with a terminal use this policy?

Thanks in advance for your help.

 

[CitrixEngineer]

I've seen this question come up many times - but to the best of my knowledge, there is no way that Terminal Services can do this on a per-device basis - only on a per-user/group basis or to the local machine.

Maybe the users could have a different login for the PCs? I know that's not exactly perfect.

I hope someone else has a better answer! CitrixEngineer@yahoo.co.uk

 

[Davetoo]

Check out KB 260370. It discusses how to apply GPO to a Terminal Server without affecting other servers and users (using Loopback processing of Group Policy). I don't think it's perfect, but it's the best I could dig up. I'm in the exact same boat, I need to lock down a TS without adversely affecting users on their local machines. Not an easy thing to do I'm finding out.