1

So if I have a GPO which has settings in for the USER but then apply that GPO to an OU with computers in, will it apply those settings to the users that login to those computers?

If no, how can I make it?!

Cheers :slight_smile:

6 Spice ups
2

If they are user configurations yes.

2 Spice ups
3

Thanks Bill :slight_smile:

Probably the most basic Group Policy stuff I should know, but I just wanted to check!

4

No it won’t - if you apply a user setting to a OU with only computers in then it will not by default apply to users logging into those computers.

You must enable loopback processing if you wish to do that.

4 Spice ups
5

Maybe I’m confused, but no. I read this:

“settings in for the USER but then apply that GPO to an OU with [only] computers”

If my clarification is true, then no they won’t apply. That is unless loopback is enabled, of course.

Edit: Craig beat me to it.

Edit 2: You can also use WMI filters, as an alternative to loopback. You would scope the GPO to a user’s OU, but apply a WMI filter so that it only applies to certain computers.

2 Spice ups
6

That’s not true…entirely

If you have a GPO that only has user configurations, and you apply it to an OU that ONLY has computers, nothing will take effect as it is not hitting any part of the policy. In order to do what you are asking, you need to enable Computer Configration > Policies > Windows Components > Group Policy >Configure user Group Policy Loopback processing mode and set it to Merge or Replace (depending, but 99% of the time you will choose merge).

What this does, is that since the computer configuration has already been done a boot-up, it looks for this policy setting when a user logs in. If it is set to “Merge”, it applies all user configurations of all the other GPOs that apply to the user, and then at the very end, re-runs the user configuration side of the group policy that has this option turned on, effectively merging all of the policies in this GPO as if you applied it to the user. If you choose “Replace”, ALL prior user configuration GPOs are discarded, and whatever is setup in this GPO that is applied to the computer OU will be the lasting effective one.

4 Spice ups
7

Very good point and I’m glad someone mentioned that because I assumed it was already being used. Thanks for mentioning that crucial piece!

2 Spice ups
8

What level is your domain/forest at? Good question! I’m now curious about that loopback feature. :slight_smile:

9

The loopback feature works with at least Windows 2000/Server 2000, so most likely you already can be using it Duells Quimby

10

yep, I’m at 2003. I’ll look to that. thanks.