GPO Security Filtering applied only to computer

Hello,
we have the follwoing Situation:
1. we created a gpo for IE Settings.
2. We want to apply this GPO to a OU and we want to limit the range to an AD Group containing only Computer accounts.
3. We know that IE Settings are normally applied to users and not for Computers. Therefore we thought we will use the loopback function.
->Problem:
the GPO is applied for computersettings, but not for the users Settings.
Any idea?

> 3. We know that IE Settings are normally applied to users and not for
> Computers. Therefore we thought we will use the loopback function.
>
> ->Problem:
>
> the GPO is applied for computersettings, but not for the users Settings.
Loopback merge or replace? And what security filter did you set? The
user accounts need apply rights, too - not only the computers :)
Martin
Mal ein
GUTES Buch über GPOs lesen?
NO THEY ARE NOT EVIL, if you know what you are doing:
Good or bad GPOs?
And if IT bothers me - coke bottle design refreshment :))

Similar Messages

Is there a way to get GPO's security filtering groups only.

Hello,
Is there a way to get the GPO and the Security filtering groups assigned or configured for that GPO.
A VBSCRIPT would be greatfull
Thanks,
Schan.

> A VBSCRIPT would be greatfull
Have a look at the GPMC samle scripts:
http://www.microsoft.com/en-us/download/details.aspx?id=14536
Also a good starter to learn about how to use the GPMC COM interface :)
Martin
Mal ein
GUTES Buch über GPOs lesen?
NO THEY ARE NOT EVIL, if you know what you are doing:
Good or bad GPOs?
And if IT bothers me - coke bottle design refreshment :))

Row-level Security Filters applied to Columns and Tables only? no Areas?

Good day all,
Just quick question (obiee 10.3.3.2) - Is there a way to edit row-level security using Whole subject areas (instead of bringing in the individual Fact tables and applying filters by copying/pasting them).
Follow up question - if I have nested facts in presentation layer (ones preceding with "-" - do I specifically add them to conditions, or would they be inherited by only including parent fact)?
Thanks!
Message was edited by:
wildmight

I'm not sure how that would help; by using the Faculty_ID Session Variable I can identify the CRN and Term of all courses a faculty member is teaching. But I don't think that has to do with the problem I am having?

How to apply Computer Configuration to users with Security Filtering?

I have a gpo that contains both user and computer settings. In order to test it, I want to link it to an OU that contains users and their computers, but I want to use Security Filtering to apply it only to certain users (I don't have their computer
names).
Is there a way to filter it to only certain users without losing the computer settings?

> Is there a way to filter it to only certain users without losing the
> computer settings?
Computers look for computer settings in a GPO they have access to.
Users look for user settings in a GPO they have access to.
SO you might simply remove "Authenticated Users" (which includes both
computers and users) from security filtering. Then add "Domain
computers" which gives all computers access to computer settings, and
add the users in question, which gives THESE users access to user settings.
Don't enable loopback and play around with it unless you are sure you
fully understand what it is doing!
http://evilgpo.blogspot.de/2012/02/loopback-demystified.html
http://blogs.technet.com/b/askds/archive/2013/02/08/circle-back-to-loopback.aspx
Martin
Mal ein
GUTES Buch über GPOs lesen?
NO THEY ARE NOT EVIL, if you know what you are doing:
Good or bad GPOs?
And if IT bothers me - coke bottle design refreshment :))

Wallpaper GPO + Loop-back Merge mode+ security filtering. issue

I have deployed a loopback Merge Mode GPO to set wallpaper for all users who logon to specified workstations. And you have set security filtering just allow workstations in specified group can apply this GPO. Then you doubt whether user can apply user configuration
in the loopback GPO because they don’t in your security filtering allow list.
So I think why not add “Domain Users” group to security filtering. Then all domain users have both Read and AGP (Apply Group Policy) permission for user configuration in the loopback GPO.
Loopback GPO only takes effect on computer objects in your specified OU, and your workstation group security filtering control apply scope, then “Domain Users” security filtering grant permissions for all users.
========================issue is below================
Now GPO is applying to other workstations which are not part of group filtered in GPO.
its randomly but not for all workstations..
Workstations are XP operating systems..

I have deployed a loopback Merge Mode GPO to set wallpaper for all users who logon to specified workstations. And you have set security filtering just allow workstations in specified group can apply this GPO. Then you doubt whether user can apply user configuration
in the loopback GPO because they don’t in your security filtering allow list.
So I think why not add “Domain Users” group to security filtering. Then all domain users have both Read and AGP (Apply Group Policy) permission for user configuration in the loopback GPO.
Loopback GPO only takes effect on computer objects in your specified OU, and your workstation group security filtering control apply scope, then “Domain Users” security filtering grant permissions for all users.
========================issue is below================
Now GPO is applying to other workstations which are not part of group filtered in GPO.
its randomly but not for all workstations..
Workstations are XP operating systems..
"Domain Users" or I would prefer "Authenticated Users" should only have Read, Not Apply Policy.
Enfo Zipper
Christoffer Andersson – Principal Advisor
http://blogs.chrisse.se - Directory Services Blog

Security Filtering for GPO processing

Hi,
I have an OU which contains all the servers accounts. I have multiple GPOs that are linked to this OU but I have a GPO that contains only User configuration part witha script to map files. Requirement is that this policy should be applied when a groups of
users logs on to a group of servers only.
If I add the required User group & required computer accounts to the Security filtering of this GPO, will it work good? Is there any other way that will give required result but with lesser GPO processing time.
Thanks
Vipin Tyagi (MCSE 2003) Windows Admin

In our environment, all GPOs are applied to Computer OUs, not a single GPO applied to User OU. Do we need to enable Loopback processing for all GPOs having user setting?
No.
Loopback Processing is rather special, in the way that, if enabled in any GPO, and that GPO is linked to an OU, all GPOs linked to that OU will operate in Loopback mode.
When you enable Loopback Processing, this changes the way that GPO is processed on computers in the linked OU.
e.g. if you enable Loopback Processing on a single GPO linked to an OU, and there are 3 other GPOs linked to that same OU, all 4 GPOs will operate in Loopback Processing mode for that OU.
For this reason, there are suggestions on how to implement Loopback Processing, e.g. create a new GPO, name that GPO something like "Enable GPO Loopback in Merge mode" or "Enable GPO Loopback in Replace mode", then link this GPO to the relevant OUs where
you need it.
Don't enable Loopback Processing in a GPO that also performs other GPO settings.
Using this method, you can quickly see (due to the display name) when Loopback Processing is applying to any OU, and, clearly see in all RSOP/GPresult data when Loopback is occurring.
[troubleshooting GPO can be tricky, particularly when you don't know Loopback is occurring]
Don
(Please take a moment to "Vote as Helpful" and/or "Mark as Answer", where applicable.
This helps the community, keeps the forums tidy, and recognises useful contributions. Thanks!)

AGPM and security security filtering: gpos not showing up in uncontrolled tab

Why Does a gpo not show up in uncontrolled tab? The only thing that is removed is "authenticated users" from security filtering of said gpo. Once I add authenticated users back, bang! its back visible in uncontrolled tab.
Adding specific groups and removing authenticated users from security filtering is a standard practice to apply group policy. Can this not be used with AGPM?
version 4.2

Hi,
For AGPM questions, in order to get accurate help, it's recommended that we ask for advice in the following dedicated AGPM forum.
Microsoft Advanced Group Policy Management (AGPM)
https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopagpm
Best regards,
Frank Shen
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]

How to prevent changes to a GPO's Security Filtering?

Hi all
We can prevent GPOs being edited but how can we prevent changes to a GPO's
Security Filtering? Is there a way to lockdown the Add and Remove options to prevent accidental
changes please?
Thanks
Scott

Hi,
Configure properly in t-code OIS2
Select serial number profile >>> Double click on serialization procedure
Maintain procedures
SDCC - Completness check for delivery
SDLS - Maintain delivery
Kapil

New Group Policy not working on 2008 RDS in 2012 Domain - Security Filtering problem?

We have a Windows 2008 R2 RDS in a Windows 2012R2 Domain. We want to lockdown the 2008 RDS for Domain users that we have added to a new security Group--named "Data Collection Users". These users are "Domain Users" and login to the
2008 RDS using Windows XP SP3 machines to run a specific application -they do not use their local desktops for anything. WE added this group to the local RDU group on the RDS. We do not have any other users that login to the RDS through terminal,
including any Domain Admins.
So far we have done these steps:
On the DC, created new OU (called Terminal Servers) and moved the RDS into it.
Opened Group Policy on the DC, and under GP Objects, created a new policy called "TS Users Lockdown".
Linked the Policy to the OU.
Under Security Filtering we removed the Authenticated Users, added the RDS computer account (called QS2), added the "Data Collection Users" and chose Allow for "Read" and "Apply Policy"
Under Security Filtering, for Domain Admins, we chose Deny for "Apply Group Policy"
We edited the Policy (under Computer Configuration>AT>SYS>GP) to Enable Loopback processing - Replace mode.
We first tested the policy by trying to remove the "Run" from startup menu and "prohibit access to Control Panel".
We ran the Group Policy force update from within GP Management - ran successfully.
We did not reboot the RDS.
Neither of the settings we tried in Step 7 worked. Why Not?
Here are images from the Security Filtering:

Ok--Do I reboot the RDS or the DC? or both?
Does it look like my Security Filtering is correct? I have seen posts where you should not remove the "Authenticated users"?

Problem assigning Essbase Security filters in Shared Services

We recently upgraded Planning/Essbase to System 9 version 931 in Test. Everything went smoothly except for few users Security didn't migrate properly.
In Shared Services, it shows that user has access to Planning & Native Essbase Applications. But in Essbase, only Planning Application access is shown.
Also when I try to apply security filters for these users in Native Essbase Applications (in Shared Services), I don't see these particular users.
There is no problem with Planning security, except when I refresh Security from Shared Services in Analytic Admin Console it wipes out Planning Application access in Essbase.
For other users there are no issues. Only for few users this is the problem. I have tried to deprovision user & provision back, but no use.
Please Help

Essbase/Planning security is multi tiered. In Shared Services you setup your groups. You provision your groups with adequate security access. Depending on whether you have updated a cetain .css file(to fix bug) you may have to assign the read, write calc access to the group not just calc, but all three if your users need the access to actually, read, write & calc. of need user to just read & write etc... then you have to go to EAS refresh, run maxl script to assign environment access to user, go back to shared services go into projects assign any needed access to calc & filter groups and essbase is setup. For planning you also have to go to workspace and migrate identities within the security setup for any of your dimensions. this comes into play when adding or removing users as filters are created in planning workspace. I just learned this from one good tech that helped me setup & remove users as I had issues getting them in and out of the system..Now to move on to actually getting security reports that make sense for planning with the associated access. If anyone has the maxl code let me know.

Terminal Server Licensing Problems with GPO Security Group License Server

Hello,
I have two fresh installs of W2K12R2.
One is RD Session Host and the other one is the License Server. Everything is fine until I active the GPO Security Group License Server. After that the License Server gives no licenses
to die clients (we have User und Device CALs). TS Licensing Diagnostic’s shows no errors, the number of available licenses is displayed correctly, even the state of GPO Security Group License Server is correctly shown as "active" and die
Membership in the Group "RDS-Endpointserver" is "Yes". Eventlog shows no Errors. Log in on the session host is even possible, maybe because the RDS-Service is in evaluation time.
If the GPO Security Group License Server is disabled again, the server starts to serve licenses as expected.
I don’t know what I can do anymore, never had problems with exact the same setup under W2K8, but with W2K12 is the second time I notice this issue.
Thanks for your ideas,
Andreas

Hi Andreas,
Thank you for posting in Windows Server Forum.
Sorry to inform but there is no official document for server 2012 related to this event, you can go through below article for reference.
You cannot use a security group to add computer accounts to the Terminal Server Computers group. You must add each computer account explicitly. To verify whether an RD Session Host server is allowed to request RDS CALs from the Remote Desktop license server,
you can use the IsSecureAccessAllowed method of Win32_TSLicenseServer class. For more details about this method, click here.
1. License Diagnosis tool returns error "License server <computer name> cannot issue RDS CALs to the Remote Desktop Session Host Server because the 'License server security group' Group
Policy setting is enabled."
2.Control the Issuance of RDS CALs
Note: You should only enable this policy setting when the license server is a member of a domain. You can only add computer accounts for RD Session Host servers to the RDS Endpoint Servers group when the license server is a member of a domain.
Hope it helps!
Thanks,
Dharmesh

Mail rules -- apply only to inbox or all mailboxes?

I've done a major revamp of my Mail application. I used to have a dozen or so mailboxes, and some had rules that would move newly arrived messages from my inbox to a designated mailbox.
I've now opted instead to use a dozen or so 'smart mailboxes.' I've moved all my messages back to my inbox and deleted the dozen or so mailboxes. The smart mailboxes nicely filter the messages as I've constructed the smart mailbox rules. However, I still have two mailboxes whose content isn't easily filtered via smart mailboxes.
Now, back to my inbox .... It's got a few thousand messages. My goal is to create a mail rule in preferences that would move anything older than 30 days into secondary mailbox. If I write this rule and run it, does it apply ONLY to my inbox? Or to the inbox and any other mailboxes?

I played around with it and found out that my rule to move older docs to a separate folder only runs on my inbox, as I had hoped.

Planning Security Filters not reflecting in Essbase filters for 2 of 4 cube

We are using Hyperion Planning with essbase. In essbase we have 4 cubes in essbase (BSCF, EMP, IS, MGN). We would like to add security for the entity dimension as we don't use it currently but we do for other dimensions.
I have created a new group (FIN_APAC) in SS so that restricted access be given to users in Asia for only their LE(s). Then I enabled security for the LE dimension in planning and set security filters through a command line load. For existing groups I gave write access to all LE members and for the new group (FIN_APAC) I gave write access to certain members.
When I refresh the security filters in planning they should reflect in Essbase and it does for 2 cubes (BSCF & EMP) but for the other cubes (IS & MGN) the essbase security filters are NONE! In planning all the LE members are set to be included in all plan types.
The main problem seems to be with this new group (CSR_FIN_APAC) as whenever this group is assigned the essbase filters are not assigned properly. For the existing groups that have added LE security for all members the security filters are updated for 4 cubes as expected.
Any help appreciated
x

When you create a planning application we can create 3 essbase cubes as plan types. if you use Capex, Workforce you can able to create max of 5 databases in Essbase version 11.1.1.3.
if it is 11.1.2 you can add one more cube
In your question, have you created 4 Essbase cubes. can you explain how that is possible.
if all the LE members in all plan types means in 3 Essbase cubes. when you refresh security from planning to essbase that works fine.
Can you explain the situation perfectly so that can able to give ans.
Thanks,
Suneel kanthala.

System 9 Security Filters and VB Essbase API

I currently maintain a lock and send Excel template sporting a custom login dialog which I use to capture the user's employee id. Having that, I then use a generic admin username/password and the API to get the security filter stored under the user's "underscored" ID on the Analytic server. I parse out the organizational entities stored in the write filter and use that to build a treeview to which the user can only select entities to which he/she can access. Basically, it gives me the ability to maintain a standard template across many lines of business. I also use the same code in a security management applet where superadmins can build/modify/delete the security filters of those people who have access to entities which are descendents of the entity to which the superadmin has access.
Anyway, I understand in System 9, there is no longer an "underscored" id. I think I read that on the Planning forum. Other than a minor code change, will this have any further impact? The write filter has been migrated over to the non-underscored filter yes? We're going to System 9 soon and I'm just trying to get my hands around the impact this is going to have on all of the API (7.1.6) code I have deployed. This is just the first question that came to me. I expect I'll be on here for a few more. Any help or advice is appreciated.

I wouldn't copy Essbase.sec from one server to another. The server name is embedded in there and it's drive/folder dependent.
What you can do is use MaxL's display filter all command and then pipe the output to a text file. In turn you can import those definitions back into Essbase with a little work.
I wonder if OlapUnderground's Advanced Securtity Manager might be used to move filters across servers and versions:
http://www.appliedolap.com/free-tools/advanced-security-manager
I've personally never used it, but I'm sure someone on this board will chime in.
Regards,
Cameron Lackpour

Win Server 2003 GPO doesn't apply to Win 8.1 clients

Hi guys,
Currently all my DCs are running Win Server 2003. Recently I've upgraded a few PCs to Win 8.1 and found out that the GPOs are not applied on them.
I've set the Default Homepage and logon script to map a few drives but when I logged on to the Win 8.1 clients, none of these are being applied. However, when I logged on to Win 7 clients, these policies are being applied.
Appreciate you guys here can help me on this.
Thanks!!

Windows 8.1 comes with IE11 which can't be configured by the old IE maintenance policies. You would need to use group policy preferences but these were introduced in Windows 2008 so I don't think you can configure IE settings for IE11 from Windows 2003 DC's.
As for the mapping of drives if this is a login script I don't see why this wouldn't work on a windows 8.1 client.
Can you run a gpresult / rsop report on the windows 8 computer and see what policies are being applied / not applied and any errors.
Regards,
Denis Cooper
MCITP EA - MCT
Help keep the forums tidy, if this has helped please mark it as an answer
My Blog
LinkedIn:

GPO Security Filtering applied only to computer

Similar Messages

Maybe you are looking for