Terminal Server GOP not being applied

[scottew]

I created a GPO to lock down a new terminal server. I created a OU called Terminal Servers. This TS is the only server in this OU. I also have a Security Group called TS Users that have access to log onto the TS. In the GPO, I added this security group under Security Filtering. There is nothing set under WMI Filtering.

I ran gpupdate /force but it still doesn't work. When I do gpresult, the GPO does not show up at all.

The following article is what I used for all of the settings.

http://support.microsoft.com/kb/278295

Any help would be greatly appreciated.

Thanks,
Scott

 

[dberg35]

Just starting with the basics here but did you reboot the server? I have something similar before and a reboot fixed the issue.

 

[scottew]

The TS has been rebooted, but I did not reboot the DC.

Thanks,
Scott

 

[dberg35]

Try rebooting the DC. Also is the GPO at domain level or OU level?

 

[scottew]

Thanks dberg35, I will reboot the DC tonight to see if that helps. The GPO is at the OU Level and only applies to the OU named Terminal Servers. There is only 1 TS in this OU.

Thanks,
Scott

 

[dberg35]

If the reboot doesn't resolve the issue try re-creating it at domain level but do not edit the default policy just add a new one.

 

[scottew]

I rebooted the DC and that did not help. I removed the security group TS Users and put back Authenticated Users. Now the GPO works properly.

The only problem is that I don't want it to be for all authenticated users.

 

[dberg35]

When you say put back did you originally delete all policy's and only create the TS one? By default a DC has a GP at domain level but you can also add more there or at OU level lit you attempted. One more question is the TS joined to the domain so users logon with their domain accounts?

 

[scottew]

When I created the GPO, by default it was to be applied to "Authenticated Users". I deleted the authenticated users and put in the TS Users security group since I only wanted the GPO applied to this group.

Yes, the TS is joined to the domain.

I deleted the TS Users security group and applied the GPO to Authenticated Users and it works.

I will just leave it like this and if I need to do any administrative work on the server, I can just log in locally.

Thanks for all the help.
Scott