Home / server / Questions / 609596
In Process
Force Flow
Asked: 2014-07-03 07:15:20 +0800 CST

Applying group policy loopback to any user on specific computers

  • 772

In a server 2008 R2 and Windows 7 environment, I have a GPO that specifies screen saver settings in the user settings policy for the entire domain. However, for specific computers, this is not ideal.

I created a separate GPO with higher precedence, enabled loopback with the replace setting, and specified the screensaver rules. In the security filter, there is only the specific computers the GPO should be applied to. However, as-is, this policy is never applied--gpresult /z indicates this under user settings for the GPO: "Filtering: Denied (Security)".

If I add the "domain users" to the security filter, then the GPO is applied to all users in the domain, regardless of which computer they are using.

How can I apply the GPO to any user who logs into only specific computers?

Applying the GPO to OUs are not an option, unfortunately, since the computers are already sorted into various OUs for other things.

[edit]: In the security filter, I tried:

  • adding only the computer to the security filter; results in GPO denied under user settings.
  • adding the computer to the security filter, and adding "domain users" to the security filter; results in the loopback GPO being applied to all users, regardless of which computer is used.
  • adding the computer to a security group, adding that security group to the security filter; results in GPO denied under user settings.
  • adding the computer and "domain users" to the same security group, and adding that security group to the security filter; results in the loopback GPO being applied to all users, regardless of which computer is used.
  • adding the computer to a security group, adding that security group to the security filter, and adding "domain users" to the security filter; results in the loopback GPO being applied to all users, regardless of which computer is used.

What other options are there left to try?

Is there a way to specify whether the items in the security filter can be combined using "and" rather than "or"?

windows-server-2008-r2

4 Answers

  1. You'll need to create a new OU for those computers, then apply the GPO to that newly created OU.

    • 2

  2. There are five ways you can do this:

    (OU Separating)

    You can separate computers and users by diferent OUs and link a policy to computers' OU. To use loopback policy, both user and computer must have read and aplly permissions for policy, so, if you separate them, then you easily can set security to 'domain users' and 'domain computers' - the policy will be applied t all users who work on computers that in OUs which policy is linked to

    (Flag-File Trick)

    Alternatively you can make a trick - you can add a 'flag-file' on a computers you need to apply GPO: You should create a user-only non-loopback policy that sets screensaver and filter it with WMI filter checking existance of local flag-file like "Select * From CIM_Datafile Where Name = 'C:\\Windows\\spc.screensaver.flag'". You should set security to Domain Users - read and apply. Second, you should make an additional policy for those computers that will create this file (this can be done easilly, will not explain). This policy must not be loopback, and it must be computer-only. Security must be set to Special Screensaver Computers - read and apply

    (Common Startup Script - Registry editing)

    Alternatively you can make a script that you should put via policy to common startup folder for computers from Special Screensaver Computers group. When any user will log on this computer, this script will execute under user rights and change some HKCU registry keys etc. So, again, this is not loopback policy

    (Hardcode computer names in WMI filter)

    Alternatively, you can hardcode computers' names in WMI filters. Oh God.

    (Use Item-Level Targeting - Registry Editing)

    Alternatively you can set up screensaver with GPP (making a registry replace policy). This supports Item-Level targeting and you can make a rule to apply registry change only if 'Computer in security group Special Screensaver Computers' - in this case you should make a loopback policy with security set to Special Screensaver Computers and Domain users - read, apply, and make a registry fix under user configuration with enabling Item-Level targeting to check if computer is in security suitable group. Note that GPP is appliable to XP SP2\3 with KB943729 installed. Not sure if Item-Level Targeting is working on XP SP2

    (---)

    Because you need to make this setting per-computer, and the policy must be applied to all users on this computers, you have to set security to Domain Users for this policy. And when user logons, it reads all policies that assigned to OU where user is placed. Currently there are only three types of filtering supported by policies - OU separation (it usually butthurt), WMI filtering and Item-Level Targeting

    • 1

  3. Have you tried WMI filtering?

    I had in my organization many loopback GPOs, and they were a mess.
    I separated all these GPOs to 'Computer policy' and 'User policy', so the 'Computer policy' applies to the relevant computers (no problem here), and the 'User policy' applies to all users but includes a WMI filter so the policy applies only on certain computers.

    Of course, a way to identify the relevant stations through WMI is required.
    You can use WMIExplorer to find what options are available.

    If there's no way to identify them properly, you'll have to resort to separated OUs.

    Here are some more examples of WMI filters.

    • 0

  4. Since this was an old question, I already ended up reorganizing everything into OUs and used a loopback policy, as was previously suggested.

    • 0