You build a locked-down desktop for a shared computer, such as a kiosk or a Remote Desktop server. Then people sign in, and each of them sees something different. One person gets a drive mapping from their department, which does not belong on that machine.
The cause is how Group Policy splits its work. Computer settings come from the OU that holds the computer object. User settings come from the OU that holds the user account. For the user part, the computer that a person signs in to does not matter.
Loopback processing changes this. You enable it under Computer Configuration in a GPO that applies to the shared computer. After that, the computer's GPOs supply user settings too. There are two modes. Replace ignores the user's usual GPO list and builds the list from the computer's location only. Merge keeps the user's list and processes the computer's list after it, so the computer's GPOs win any conflict. Note that a GPO linked to the domain still applies in replace mode, because the computer is in the domain as well.
To see which GPOs a user really gets, sign in on the shared computer as that user and run:
gpupdate /force
gpresult /r /scope user
Some user settings apply only at sign-in, so sign out and in again after the update. Then check the list under "Applied Group Policy Objects". In replace mode, a GPO linked only to the user's OU must not be there.
The full guide compares the modes on one example with three GPOs. It shows how to create and link the GPO, and why both halves must stay enabled. It covers the permissions the computer account needs, testing with the Group Policy Modeling Wizard, and a common mistake with replace mode.
Read the full guide: https://learnitlessons.com/articles/gpo-loopback-processing-explained/
Written with AI assistance and checked by the author.
Top comments (0)