Loopback GPO on Replace prevents other user GPOs from applying

I had the need to create a GPO and use a loopback.  Simple little GPO, just to add some stuff to trusted sites on a specific Citrix server.  I created it as a user GPO then did a loopback so I could apply it to only the application hosting XenApp
server I wanted.
I set the loopback to replace, just because it was default and the trusted site settings were not applied anywhere else; I didn't really care.
Long story short, when I linked that GPO, it, for some reason, prevented all other user GPOs from applying.  Not denied, they just didn't even show up.  
I figured it out shortly after, and when I changed it to merge, the other user GPOs applied again.  This is not the way I believe Loopback is supposed to work, in either replace or merge.  
Any insight on why that might have happened?

> Long story short, when I linked that GPO, it, for some reason, prevented
> all other user GPOs from applying.  Not denied, they just didn't even
> show up.
> I figured it out shortly after, and when I changed it to merge, the
> other user GPOs applied again.  This is not the way I believe Loopback
> is supposed to work, in either replace or merge.
 This actually IS the way it is supposed to work:
http://evilgpo.blogspot.com/2012/02/loopback-demystified.html
http://blogs.technet.com/b/askds/archive/2013/02/08/circle-back-to-loopback.aspx
Martin
Mal ein
GUTES Buch über GPOs lesen?
NO THEY ARE NOT EVIL, if you know what you are doing:
Good or bad GPOs?
And if IT bothers me - coke bottle design refreshment :))
That makes a lot more sense.
What it says on the GPO itself is:
"Replace" indicates that the user settings defined in the computer's Group Policy objects replace the user settings normally applied to the user.  
I was interpreting that as GPOs it would replace were only the settings in the loopback.

Similar Messages

  • How to prevent other users to send mails from SAP?

    Hi,
    Our test system is a copy of the prod.  We could not deactivate the mail job because it is also used by solution manager.  So how can we prevent other users to send mails from SAP? 
    thanks,
    krbas

    Hi K Bas,
    Then I will suggest trying this option out. In SCOT select the node for SMTP (depending on if you are using standard SAP node). Double click and a push button will come Now in the pop you will have option for Internet with a push button SET besides. Please go there. In the next screen you will find a filed for Address area. Now in this field give the value as *.sap.com
    Using address area you can decide to which e-mail addresses is the mail sent to. Since the OSS message will go to <abc>@sap.com that is why I have suggested to use *.sap.com
    I mean if you want that mails should be sent via SAP only yahoo mail accounts then you will give value as *.yahoo.com only. Same thing needs to be applied for SAP.
    Try this out and let me know.
    Please award points if solved.
    Regards.
    Ruchit.

  • Cannot lock the page to prevent other users from editing it. Please try again later. Error with ASP pages

    Cannot lock the page to prevent other users from editing it.
    Please try again later.
    I get t his error when I try to edit ASP pages on my web
    server, I have all admin rights, anyone know a fix for this?

    App Store support. There is troubleshooting and a contact link.
    Support

  • How can I delete the other user reviews from the apple app developed by me

    How can I delete the other user reviews from the apple app developed by me

    As a registered developer you have access to the registered developers discussions area and direct access to the appropriate Apple personnel in regards to such a question. Pretty sure app reviews can't be deleted, but this is far from the appropriate place to get an answer for this.

  • Preventing other users from seeing my files

    Hi,
    I'm not exactly a UNIX person but the below folder:
    drwx------ 8 myfolder staff 272 Dec 27 17:34 myid
    Should only be readable by myself (myid) right? I see no group permissions. So why are other users able to navigate into this folder and see its contents?
    Thanks,
    Brandon
    Message was edited by: bmm727

    Done - but it doesn't seem to be that different.
    togoshis-MacBook-Pro:~ myid$ ls -ladeO myfolder
    drwx------ 8 myid staff - 272 Dec 27 17:34 myfolder
    I did notice that other folders which MacOS sets up as not readable by other users (e.g. - folders in the user directory) have a permission more like this:
    drwx------+
    I'm not sure what the trailing '+' represents.
    Oh and Happy New Year all.

  • HT4191 Notes getting mixed up and or replaced with other users i-phone?

    For some reason whenever I sync my i-phone 4s and my wife syncs her i-phone 4 to itunes on our laptop which is a compaq(I don't know if that might be a problem) by the way, some of her notes always gets deleted and gets replaced with my notes, and she'll have just a couple of her notes but most of mine. It's been driving us crazy for months now cuz we can't figure it out! Do we need to sync our phones on different computers? Is there a setting that I'm missing? What are we doing wrong????

    Please let me know whether you experience the following issue, and submit feedback (or if you are an Apple Developer, a bug report). This issue is not related to synchronization.
    Title/Subject:
    Contacts 7.1 replaces one contact's Notes with another contact's Notes
    Summary:
    This issue's significance is severe because data is permanently lost: After searching for contacts and editing one of the contact's Notes, all found contacts' Notes are replaced with the changed contact's Notes.
    Steps to Reproduce:
    1. Launch the Contacts 7.1 app in OSX 10.8.2.
    2. Search for a string that appears in several contacts' Notes field.
    3. Click on one of the contacts in the search results.
    4. Ensure that "Edit Card" mode is NOT enabled.
    5. Alter the found string in the contact's Notes field.
    6. Click on a different contact in the search results list.
    Expected Results:
    The change is saved and the changed contact disappears from the search results list.
    Actual Results:
    All found contacts disappear from the search results list, and all found contacts' Notes are replaced with the changed contact's Notes.
    Regression:
    This issue did not exist in OSX 10.7's Address Book app. I have not had the opportunity to test earlier releases of OSX 10.8's Contacts app.
    Notes:
    Example:
    Suppose a search for "P1" finds three contacts:
      Name: Alan  |  Note: Ask permission. P1
      Name: Betsy  |  Note: Backup files. P1
      Name: Charles  |  Note: Call. P1
    While "Edit Card" mode is NOT enabled, in Alan's note, change "P1" to "P2". Then click on Betsy in the search results list. Betsy and Charles' Notes are erroneously and permanently replaced with Alan's Note:
      Name: Alan  |  Note: Ask permission. P2
      Name: Betsy  |  Note: Ask permission. P2
      Name: Charles  |  Note: Ask permission. P2

  • When I logoff & click close button for OWA , I don't get message w/ IE. "To complete logoff process & prevent other users from opening your mailbox, you must close all browser windows and exit browser application." Result is - I don't logout.

    Mozilla Firefox 4.o Beta 3
    Windows XP SP3

    Clear the cookies from that website to get logged off.
    Remove Cookies, use the search bar or click the [[Site Identity Button]] on the location bar and go to "View Cookies" via the More Information button in the pop-up.
    * Tools > Options > Privacy > Cookies: "Show Cookies"
    You are running an old Firefox 4.0 beta 3 version.<br />
    Any reason why you haven't installed the Firefox 4.0 release?
    * http://www.mozilla.com/en-US/firefox/all.html

  • How do I prevent other System Adminstrators from unlocking by machine?

    I have set up a screen saver that is password protected. Once locked, I can then touch the mouse and the logon dialog box displays where I can enter my username and password and get back into the system. If I lock the system and another administrator of the system touches the mouse, the other administator can enter their username and password to unlock the system. When the system is unlocked they then logged is under my account, not their own.
    Is there a way to prevent this from happening or another way to lock the system without having to log off every time I am away from the system?

    Disable autologin via System Preferences->Accounts. Admin users are trusted agents. If you don't trust them and it's your computer, disable admin privileges. Then, always logout when you leave the machine.

  • XK03 can be restricted by account group in order to prevent general users

    Hello Gurus,
    Please advise, if XK03 can be restricted by account group in order to prevent general user population from displaying employee data ?
    I understand that XK03 has auth object  F_LFA1_GRP for account group in which I restricted with 03 and particular account groups but still the test is failing because the test user is able to view employee data.
    Please suggest..
    Regard's
    Salman

    Hi Alex,
    Thank you !
    By your last update, do you mean auth group or account group? If you are talking about auth group then this auth object F_LFA1_BEK (XK03) has auth group.
    I checked the F_LFA1_GRP  is active in SU24. Is there something which i need to look in F_LFA1_BEK for particular auth group after restricting the auth object F_LFA1_GRP with account group ?
    Thank you for your valuable suggestions
    Regard's
    Salman

  • TS3276 There are two User accounts on my iMac. The two Users have seperate email accounts.  Both email Mailboxes show up in each Account.  If I Delete Mailbox from in User account, does it delete the Mailbox from the other User account at the same time?

    There are 2 Users on my iMac.  Each User has their own email account.  Both account Mailboxes show up in each User's account.  If I delete a Mailbox in one account, does it delete the same Mailbox in the other Account? 

    If you click the - sign in Mail preferences, it will delete that mail account. If you just delete the Mailbox, that will just delete the Mailbox.
    Each user can put their own email account information in Mail when logged into their User Account.
    If you don't want the other user's mail account to show up in your mail application, then make sure the other user's messages are available to them when they are logged into their account and delete the other user account from Mail in your User Account. The other user can do the same when logged into their user account. Any messages stored in one locally will have to be transfered to the other's user account if it's not saved in their user login.
    In addition, instead of deleting the account at first, highlight the account and open the Advanced Tab and disable the account. That email account will dissappear from Mail. Once you decide that you don't want the account, you can delete it. If you need to get back to it to transfer messages, just re enable it.

  • Will interlocked operation only prevent other interlocked operation on the same location or any visit to the same location?

    when reading
    https://msdn.microsoft.com/en-us/magazine/cc163715.aspx , i found the following statement:
    interlocked operations guarantee that the update is atomic. This requires the processor to insure that no other processor is also trying to execute an interlocked operation on the same location at the same time.
    my question is, what if other thread is trying to read the same location at the same time without using a interlocked operation, will an interlocked operation prevent this?
    I was using a readerwriter lock to sync my threads operation on an object. and i found interlocked.compareexchange is handy to initialize the object: interlocked.compareexchange(ref object, FunctionThatReturnAnIntializedObject(),null). However, i am not
    sure whether other threads can read that object during the interlocked operation? If they can, how can i prevent them?

    "However, i am not sure whether other threads can read that object during the interlocked operation? If they can, how can i prevent them?"
    If I understand correctly you're trying to lazy initialize a variable.
    Why aren't you using Lazy<T> to begin with, it does exactly what you want if you use LazyThreadSafetyMode.PublicationOnly.
    But to answer to your question: mixing interlocked and non-interlocked accesses is problematic. There are a lot of cases where doing this won't work and some cases where it works.
    In your particular case this interlocked/non-interlocked mix should work fine. In addition to being atomic .NET's interlocked operations are also supposed to be full fences. A full fence prevents other read/writes from being moved before/after the interlocked
    operation and that's exactly what you need to prevent the writes required to initialize the object from being moved after interlocked.
    If the thread that doesn't use interlocked to read the object variable gets a non-null reference then it means that the initialization of the object was done, otherwise it couldn't have got a non-null reference in the first place.
    There is a small chance to run into a problem caused by compiler optimizations. If the thread that doesn't use interlocked has a loop like the following then it's possible that the loop will never end.
    while (object == null) { ... }
    That's because in the absence of volatile and interlocked the compiler can read "object" into a register before the loop. The loop test will keep comparing the register value with null and the loop will never end. Such a situation is rather unlikely
    but you should make the object variable volatile to avoid this.

  • GPO: CD and DVD: Deny write access prevents user from using their USB Pen drive, but other users or ok

    My Users have secure pen drives that launch a CDROM partition with a secure logon app that decrypts the main USB mass storage element of the pen drive on successful logon. The problem I have is that users who install the usb pen drive cannot then
    initialize the CDROM launcher app to input their password to access the mass storage element of the pen drive making it useless.
    However, any other user that has the same type of pen drive who then plugs it in to the endpoint that already has the drivers installed is able to access their own pen drive or the other users pen drive (providing the know the password).
    So I've isolated the problem being down to the presence of the GPO setting stated above on the Removable Storage Access Policy, and by not having this policy in place when a user installs the pen drive they have no issues, but I can't find a way to clean
    up a user who is already broken even if I remove the GPO from that user, delete their local profile so that they logon as a new user (no roaming or other data) and use a variety of utilities such as USBOblivion to clear out the registry and file system of
    the USB device and installation. When the original user logs back on and then installs the usb pen drive again they have the same issue, but no other users do. I have the same issue if I try this with an alternative user or admin as the first user after the
    'clean up'. Everyone else can use the pen drive except the user that originally installed it when the GPO was in place.
    If I move the user to a new endpoint or rebuild their endpoint then they have no problem being the installer of the usb pen drive and then using it since the GPO was removed, so what I need to know is what is it about the USB install and the GPO that
    is tattooing in Windows somewhere and how do I remove it? 

    Hi,
    In my opinion, this is probably not Windows GPO problem. To confirm the suppose, you can follow the path below to check GPO settings if there is any change after the software installed.
    Computer Configuration\Administrative Templates\System\Removable Storage Access
    User Configuration\Administrative Templates\System\Removable Storage Access
    These two policy manage system and current user Removable Storage access.
    If there is no change with these policy, it would be better to contact the manufacture of the driver for further assistance.
    Roger Lu
    TechNet Community Support

  • User GPO not applying

    I have just started at a new company and trying to to setup some new GPO's
    We have all the users in a root OU called Accounts
    We have  all the computers in a root OU Company\Workstations
    There are a number of GPO assigned to the "Workstations" OU for both Users and Computer Policy's
    I would like to add some new GPO's to the Users OU for Uses settings but they will not apply or appear.
    I have run a Group Policy Results on a few workstations and I can see the GPO being applied from the Workstations OU but none from the Users OU.  However if I set the GPO to run off the Workstations OU it appears.  
     

    > GPO's in the Workstations OU and if there are any users settings I will
    > have to create a new GPO in for the Accounts' OU for any user settings
    > before I disabled the Loopback GPO?
    Basically "yes". Alternatively change Loopback "replace" to Loopback
    "merge".
    Martin
    Mal ein
    GUTES Buch über GPOs lesen?
    NO THEY ARE NOT EVIL, if you know what you are doing:
    Good or bad GPOs?
    And if IT bothers me - coke bottle design refreshment :))

  • How can I block all other mail account just to only use the exchange mailbox of our company? This is to prevent the user to setup his on company iPhone.

    How can I block all other mail account just to only use the exchange mailbox of our company? This is to prevent the user to setup his on company iPhone.

    I don't know if I'm asking this all in a way that can be understood? Thanks ED3K, however that part I do understand (in the link you provided!)
    What I need to know is "how" I can separate or rather create another Apple ID for my son-who is currently using "my Apple ID?" If there is a way to let him keep "all" his info on his phone (eg-contacts, music, app's, etc.) without doing a "reset?') Somehow I need to go into his phone's setting-create a new Apple ID and possibly a new password so he can still use our combined iCloud & Itunes account?
    Also then letting me take back my Apple ID & password, but again allowing us (my son and I) to use the same iCloud & Itunes account? Does that make more sense??? I'm sincerely trying to get this cleared up once and for all----just need guidance from someone who has a true understanding of the whole Apple iCloud/Itunes system!
    Thanks again for "anyone" that can help me!!!

  • How do I prevent other Mac users from changing my Airport Extreme Network Name and Password within the Airport Utility?

    How do I prevent other Mac users from changing my Airport Extreme Network Name and Password within the Airport Utility?  My company is using an Airport Extreme in our office now and I want to prevent other employees from messing with the network/settings.  Is there a way to place a password on the settings to allow only the admin to access the network name and password? 

    Hi - you have will have to change the device passwords on all the base stations and then don't give them to anyone except the administrators and tell them not to save them on their computers that use the older versions of the Airport Utility - for the newer versions like the mobile apps, as soon as you enter the pasword it is saved and is visible in the advanced pane along with the network password - so if anyone gets a hold of your iPad or iPhone, they can edit the whole network - I have this same issue with my networks in the office and it is inconvenient but doable - I hope this helps

Maybe you are looking for