Jeff
Sun Sep 28 21:46:09 CDT 2003
There is a KB/whitepaper specifically talking about the details of using
Group Policy to achieve specific results with a Terminal Server. You can go
to www.microsoft.com/windows and find the technical documents on several
related concepts.
Specifically, what you are looking for here is "Loopback Policy". When using
Loopback, you create the OU where your TS object is placed, then configure a
policy in that OU in which any "user configuration" settings you want to set
are ticked as you want them. In addition, the Computer Configuation, drill
into the Group Policy section and enable Loopback Mode. This will cause the
user configurations you set to apply to any user logon at this machine even
though the user AD objects are located somewhere else. Essentially this
makes the standard user logon process for Group Policy go through building
the normal User policies that user would have, and then these Loopback
policies are ammended to those. The end result will be a summary combination
if you use Loopback in Merge Mode, or else in Replace Mode you essentially
cause the normal user policies to be entirely ignored and only the policies
set in the loopback enabled policy will apply to the User session.
"Pete" <pete@btopenworld.com> wrote in message
news:eBG9ctdhDHA.1800@TK2MSFTNGP09.phx.gbl...
> My company has serveral directors who have two computers. One in the
office
> on the LAN, and one at home. They use their home PC to connect in over a
VPN
> and use Terminal Services to access their data. I therefore, have two
> servers set up, a SBS2K server and a Win2K Server set up for Terminal
> Services in Application Mode.
>
> I would like to configure a group policy to disable various aspects of the
> directors terminal services sessions (such as disable the shutdown
command,
> etc.) but allow them normal access to their LAN PC's. I know it is
possible
> to limit their Terminal Services sessions by settings up a OU in Active
> Directory > setting a User-based group policy with the appopriate settings
> on that OU > and finally moving the user account into the OU. Does anyone
> know how to achieve a scenario where, when they log in at the office these
> settings don't apply?
>
> Any help would be much appreciated.
>
> Pete
>
>