0

I am part of an IT team who was recently assigned to GPO related tasks. I am pretty new to GPO and still getting a grasp about it.

I recently received a request related to certain GPO user configuration that needs to be enabled however the catch is , it is related to an existing GPO loopback policy which i am still unfamiliar of. Can someone help me understand what needs to be done in order fulfill this task. Badly need some insights.

Here is the situation:

The customer wants this particular configuration to be enabled on his end alone . I found out that there is currently an existing GPO where the user's workstation is linked into. This GPO is currently setup in loopback policy and that specific user configuration is disabled and linked to Laptop OU where the user's workstation is located into (basically from what i understand, this GPO is currently being applied to all Laptop OUs and this specific user configuration is disabled).

Domain > Windows 10 > Laptop (this is the OU where the GPO is currently applied into)

The customer now wants to create a specific security group created and have all users who wants to have that user configuration enabled there, the problem is it is located in different OU.

Domain > Users > Location User (this is the OU where the customer wants that specific group to be created)

My question is how will i configure the GPO (user configuration set to enabled) and link it to the "Users OU" when there is an existing GPO in the Workstation OU (user configuration set to disabled and loopback policy - merge is enabled) without having any conflicting issue.

Improve this question

1 Answer 1

Reset to default
0

That request will not work. The security group and the OU that you link the policy to do not matter, it will always be overridden by the policy that you linked to the workstation OU.

The purpose of loopback policy processing (the way you have it configured), is to ignore absolutely all of the other policies that the user account is in scope for.

It could be possible to perform a merge, but that change itself is likely not trivial or the optimal solution.

You need to evaluate the underlying requirements.

Improve this answer
1
  • initially what i am planning to do is this.. when i create a new GPO that enables that user config and link it to the USERS OU, what will take effect? 1. Is it the new GPO that ENABLES the user config and currently linked to users OU? OR 2. Is it the old GPO (configured as loopback - merge) that DISABLES the user config and linked to Laptops OU? Sorry i am getting confused as well in what will take effect. Commented Feb 12 at 16:35

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.