Today we are going to assign user settings on servers, a question that I have received on more than a few occasions. How to enable user policies on computer objects.
The GPO-setting is one that is much debated on the net and elsewhere and has been for years. This is nothing new at all but I will try to explain what it actually does.
“User Group Policy Loopback processing” is the magic word that gives the possibility to assign user policy settings to computer objects. Well… sort of. It does not actually apply to computer objects… but it applies to all users that logon to a certain computer object. I am not a GPO-guru as much any more since I tried to get away from the traditional server admin role a few years back.
The setting was originally meant for “kiosk” type computers that need a far more stringent policy than other registered users might need.
This is very handy for us (you) admins that want our support personnel to have higher security on their accounts when logging on to key servers in your enterprise for example. Things like setting the screen saver to 1 min idle time and then locking the console.
Screen saver is a typical user setting that might not need to apply to their local PC but really should apply to all servers that they log on to. (This is again up for discussions outside the scope of this guide).
So, let’s get to it. Run gpmc.msc and create a new GPO. We’ll begin by activating the loopback mode that allows us to assign this policy to computer objects.
Computer Configuration \ Policies \ Administrative Templates \ System \ Group Policy \ User Group Policy loopback processing mode
I Chose to use Replace mode to overwrite any setting that might be there.
Then I set the ScreenSaver values under the User node of the GPO as usual.
Then you link your GPO to some OU that has computers and try it out.
As you can see, the policy has taken effect.
This might come very handy for Terminal Servers as well where yo might want to use the Internet Explorer hack to get higher user density out of your servers.
