TS Profile Question

[nsanto17]

I have an OU that has some group policies to restict the desktop. I am currently using local profiles for each TS user. Since their desktop and app list is standardized i would like to start using the Terminal Server specific profiles and i can just store 1 profile on my server for all my users. However when i create the test user which is in the same OU as everyone else and set the TS Profile none of the Group Policies get applied.

Am i missing something.

I am setting the TS profile to

\\<server name>\Profiles$\TS_Profiles\Sales

The test user does have access to that directory but it seems that the GPOs are not applying.

Anyone have any ideas?

 

[markdmac]

Do the policies apply to non TS users in that OU? Is the test user a member of the same groups? How is the security set in the GPO? Who (users or groups) are listed with the APPLY right in the GPO security settings?

I hope you find this post helpful.

Regards,

Mark

Check out my scripting solutions at

http://www.thespidersparlor.com/vbscript

Work SMARTER not HARDER. The Spider's Parlor's Admin Script Pack is a collection of Administrative scripts designed to make IT Administration easier! Save time, get more work done, get the Admin Script Pack.

 

[nsanto17]

Thanks for replying Mark... The only users in that OU are TS users. The test user is a member of a different group. I will test it today with the test user in the same group as everyone else. I am not sure i know what you mean by which uses/groups are listed with the apply right in the GPO security setting.

 

[markdmac]

Edit the GPO. Right click the top most part of the tree on the left pane. Click Properties. Click the Security tab. Scroll down, the APPLY property is just below the bottom showing part of the list.

I hope you find this post helpful.

Regards,

Mark

Check out my scripting solutions at

http://www.thespidersparlor.com/vbscript

Work SMARTER not HARDER. The Spider's Parlor's Admin Script Pack is a collection of Administrative scripts designed to make IT Administration easier! Save time, get more work done, get the Admin Script Pack.

 

[nsanto17]

The test users group is not even in the list. Come to think of it i never added any groups to that list so its set to its default settings.

 

[markdmac]

I would explicitly add the users in and also deny application to the Admin so you don't lock down any admin accounts.

I hope you find this post helpful.

Regards,

Mark

Check out my scripting solutions at

http://www.thespidersparlor.com/vbscript

Work SMARTER not HARDER. The Spider's Parlor's Admin Script Pack is a collection of Administrative scripts designed to make IT Administration easier! Save time, get more work done, get the Admin Script Pack.

 

[nsanto17]

I did wht you suggested an i still have the same problem.

Here the wierd thing. I created a new test account (Test1) in the same OU as all my other TS users. With out the TS profile filled out everything works fine. For some reason once i enter the TS profile path it ignores the GPOs.

I will try to delete my TS profile and start from scratch. Anyone else have any ideas?

 

[markdmac]

Is the profile a mandatory profile? Does the user have write rights to it to allow the GPO to change it?

I hope you find this post helpful.

Regards,

Mark

Check out my scripting solutions at

http://www.thespidersparlor.com/vbscript

Work SMARTER not HARDER. The Spider's Parlor's Admin Script Pack is a collection of Administrative scripts designed to make IT Administration easier! Save time, get more work done, get the Admin Script Pack.

 

[nsanto17]

it is not a mandatory profile.

Heres the wierd thing. With the TS profile entered the GPOs to not get applied. once i remove the TS Profile then the GPOs get applied and everything is great.

Since all of my TS users need the same desktop/security i figured TS profile would be the best way to go. Is there a better way.

Thanks

Nick

 

[markdmac]

When logged in with the TS profile, have you tried doing a GPUPDATE /Force?

I hope you find this post helpful.

Regards,

Mark

Check out my scripting solutions at

http://www.thespidersparlor.com/vbscript

Work SMARTER not HARDER. The Spider's Parlor's Admin Script Pack is a collection of Administrative scripts designed to make IT Administration easier! Save time, get more work done, get the Admin Script Pack.

 

[nsanto17]

yes i have. I just tried it again and can't figure this out for the life of me. argg...

 

[markdmac]

And you don't have the local loopback turned on?

I hope you find this post helpful.

Regards,

Mark

Check out my scripting solutions at

http://www.thespidersparlor.com/vbscript

Work SMARTER not HARDER. The Spider's Parlor's Admin Script Pack is a collection of Administrative scripts designed to make IT Administration easier! Save time, get more work done, get the Admin Script Pack.

 

[nsanto17]

Nope

 

[markdmac]

What do you get from GPRESULT? Did you explicitly set the security int he GPO? Have you tried using No Override? Have you tried linking the GPO higher in the tree?

I hope you find this post helpful.

Regards,

Mark

Check out my scripting solutions at

http://www.thespidersparlor.com/vbscript

Work SMARTER not HARDER. The Spider's Parlor's Admin Script Pack is a collection of Administrative scripts designed to make IT Administration easier! Save time, get more work done, get the Admin Script Pack.