Windows Tip: Troubleshooting Group Policy processing on terminal servers
Send your Windows question to Mitch today! | See other Windows tips
Here's a tip concerning troubleshooting Group Policy application when you have Windows terminal servers on the back end of your Windows clients. User Configuration policy settings will usually be applied when a user logs on to a terminal server, with one main exception: when the terminal server is configured to use loopback processing with replace mode.
Loopback processing is an advanced Group Policy setting that can be useful in certain types of environments, and when you enable loopback you have two options for how to configure it: replace mode, in which the GPO list for the user is replaced by the GPO list that was obtained for the computer at startup; and merge mode, in which the final GPO list is a concatenation of these two lists (the user's GPO list and the computer's GPO list obtained at startup) with the computer's GPOs list having precedence if any settings should conflict.
How does all this apply to terminal servers? Well, if loopback with replace mode is configured on your terminal server then that means the user's User Configuration policies won't be applied. Instead, only those User Configuration settings obtained from GPOs linked to the OU tree where the terminal server's computer account will be applied. On the other hand, having merge mode configured on your terminal server means that the user's User Configuration policies will be applied first and then the User Configuration settings on the OU tree for the terminal server will be applied next.
So my tip this time is this: if User Configuration settings aren't being applied as expected for users in a terminal server environment, how can you check whether the problem is arising from having loopback processing in replace mode enabled on your terminal server? Open regedit.exe on your terminal server and check for the presence of the value UserPolicyMode under the HKLM\Software\Policies\Microsoft\Windows\System registry key. If this value exists and is equal to 2, then loopback with replace mode is enabled on your terminal server. If the value is 1 however, then loopback with merge mode is enabled instead. And if the value isn't present, then loopback is not enabled and you'll need to try something else to troubleshoot the issue.
ITworld.com
Symantec Backup Exec 12 and Backup Exec System Recovery 8 deliver industry leading Windows data protection and system recovery. Download this whitepaper to find out the top reasons to upgrade and how to get continuous data protection and complete system recovery.
Data and system loss — from a hard drive failure, malicious attack, natural disaster, or simple human error — can happen anytime. Don’t leave your business vulnerable. Make sure you have a secure recovery strategy in place. Symantec's latest backup and system recovery technology can efficiently restore critical applications, individual emails and documents and even restore your entire system in minutes in the event of a loss.
Businesses face a growing challenge to ensure that the IT environment is properly protected. Backup Exec 12 integrates with other applications in the Symantec family of products, to complement your current data protection strategy, keep your data securely backed up and make it recoverable when you need it most.
