>NULL: January 2014

Monday 13 January 2014

Group Policy Loopback processing in 2008 R2

Although you can do some real damage with Group Policy it is amazingly simple to use (and stay out of trouble/confusion) if you follow some rules.

Keep policies separated by function (firewall, desktop features, IE features, etc) and by Computer vs User policy.

Name your policy objects something like User-Enable-IE-Setting or Comp-Disable-Power-Setting this will allow you to see which objects your policy will affect and cut out confusion as to why it isn't working without re-researching your previous work.

Another convention I use is Comp-Loopback-User-Setting, I use this when GP Loopback Processing is enabled.

So what is GP Loopback Processing?

Loopback processing allows User Policies to apply to Computers.


Here's how it works.
Lets say there is a user policy you want to use on a specific group of computers, ordinarily you would not be able to apply it unless you link it to the user as it would be ignored if linked to the computer. However those settings would then be applied wherever that user logs in, this is where Loopback processing comes in.

Loopback Processing is just a GP Computer Policy, if you enable it on a User Policy and link the policy to a computer (Via an AD OU containing the computer/s) any user that logs in on the computer will have that specific User policy applied.

In Summary then,
'User Group Policy loopback processing mode' can be found in 'Computer Configuration/Policies/Administrative Templates/System/Group Policy' set it to Enabled and 'Replace' on a Group Policy Object with User policies, link it to a computer and the user policies will apply to that computer.