Windows Tip: Troubleshooting Group Policy processing on terminal servers

April 6, 2007 —

Send your Windows question to Mitch today! | See other Windows tips

Here's a tip concerning troubleshooting Group Policy application when you have Windows terminal servers on the back end of your Windows clients. User Configuration policy settings will usually be applied when a user logs on to a terminal server, with one main exception: when the terminal server is configured to use loopback processing with replace mode.

Loopback processing is an advanced Group Policy setting that can be useful in certain types of environments, and when you enable loopback you have two options for how to configure it: replace mode, in which the GPO list for the user is replaced by the GPO list that was obtained for the computer at startup; and merge mode, in which the final GPO list is a concatenation of these two lists (the user's GPO list and the computer's GPO list obtained at startup) with the computer's GPOs list having precedence if any settings should conflict.

How does all this apply to terminal servers? Well, if loopback with replace mode is configured on your terminal server then that means the user's User Configuration policies won't be applied. Instead, only those User Configuration settings obtained from GPOs linked to the OU tree where the terminal server's computer account will be applied. On the other hand, having merge mode configured on your terminal server means that the user's User Configuration policies will be applied first and then the User Configuration settings on the OU tree for the terminal server will be applied next.

So my tip this time is this: if User Configuration settings aren't being applied as expected for users in a terminal server environment, how can you check whether the problem is arising from having loopback processing in replace mode enabled on your terminal server? Open regedit.exe on your terminal server and check for the presence of the value UserPolicyMode under the HKLM\Software\Policies\Microsoft\Windows\System registry key. If this value exists and is equal to 2, then loopback with replace mode is enabled on your terminal server. If the value is 1 however, then loopback with merge mode is enabled instead. And if the value isn't present, then loopback is not enabled and you'll need to try something else to troubleshoot the issue.

ITworld.com