1

Is it possible to create a GPO preference to map a drive for users only when they login to a certain machine? For instance, I need drive E: mapped when they log into a server named TEST, but I don’t want it to try and map E: when they are logging onto their normal PCs (E: is likely used by a DVD drive for example).

10 Spice ups
2

Stab in the dark but assign the drive map GPO to the user / group and WMI bind it to the server?

4 Spice ups
3

With Item Level targeting it’s possible. You can target multiple conditions IE a certain user AND a certain machine. You’ll probably want to limit the scope of the GPO down so it’s not applied unnecessarily. Perhaps add the computer or user to a security group and use delegation to limit the GPO applying.

24 Spice ups
4

Yep, this is executed/implemented by using what are called “Group Policy Preferences.” One of the best additions to GPO functionality IMO.

The security filtering will probably complicate things - i.e. is likely unnecessary for the scenario, but if you’re running a larger environment with lots of GPO’s this would be a good idea.

5 Spice ups
5

Another way to skin this is to implement loopback GP processing on those computers that you want that drive mapping to appear on. It’s designed to handle these scenarios. It does, however, complicate things, so I would tend to agree that if you can use Item-level targeting in GP Preferences Drive Mappings to sufficiently control where the drive mapping applies to the user, then that’s probably a better approach.

Darren

7 Spice ups
6

Just tested item level targeting and it’s working a treat! Thanks all for the quick help

1 Spice up
7

Not to mention, depending on how you have your OUs and GPOs laid out, this could cause things to apply that you didn’t intend to have apply. I’d say the odds of that are quite small, but it’s something to consider. Also, Loopback Merge can cause a noticeable increase in logon times if you have a lot of GPOs.

8

You can use item level targetting for more than just network mapping, you can also do logon scripts, printers, even allow local admin on specific machines, it has to be one of the coolest things I have done/learned with GPO.

9

techcoord wrote:

…you can also do logon scripts…

Where can you do logon scripts with ILT?

10

I don’t believe you can use ILT with logon scripts so you would need to identify registry keys and do aa if,then else on the batch level.

1 Spice up
11

No, Item-level targeting is strictly limited to GP Preferences settings–so Logon/Startup Scripts don’t leverage them. I did blog about a “trick” you could use to essentially leverage Item-level targeting from all policy areas a while back, and for the life of me, I can’t find the blog post, but it amounted to the following:

Create a GP Preferences Environment Variable policy that delivers an environment variable to the target system, based on the Item-level targeting you’re interested in. Then, use WMI filters on non-GP Preferences GPOs to test for the presence of that Environment Variable and voila! It’s a bit round-about, but in a pinch, it works :slight_smile:

Darren

1 Spice up