Terminal Server Loopback Policy and Excluding Admin

active-directorygroup-policyloopbackwindows-server-2003

I have my Terminal Servers (Windows 2k3) in their own OU with their own Group Policy. Loopback "merge" is enabled and everything, in general works OK.

For Computer Configuration, under Policies/Administrative Templates/Windows Components/Terminal Services/Terminal Server/Remote Session Environment I have some settings defined. In particular, "Start a program on connection" which starts the only app they need on the terminal server. Works great. When they exit the app their session ends.

However, I don't want that app to launch when I connect as a Domain Admin. In that scenario, I need the normal TS experience. I visited Delegation -> Advanced for the policy and set "Apply Group Policy" to Deny for Domain Admins. However, that only impacts the User Config, not the Computer Config (verified by gpresult) which is, upon reflected, as I'd expect (right?).

So… what's the proper way to exclude loopback processing for a user or group?

Best Answer

That is a per-computer setting, there isn't really anything you can do at the policy level to change that per user.

One thing you could do. When the admins login they should be able to specify a program to start in their terminal client. Just start explorer.exe.

Related Topic