LOOPBACK PROCESSING GPO WINDOWS

In this scenario, any setting under the вЂњuserвЂќ portion of the GPO will have to monolithic, meaning every user will have the same setting. In the scenario where the integrator has no control over the GPOвЂ™s on the userвЂ™s OUвЂ™s, and the GPOвЂ™s could very well be conflicting, (in terms of which drive letters are hidden or revealed, for example, or how locked down a machine is), the integrator can use вЂњloopback-replaceвЂќ, to cancel out any user-settings that may have been assigned at the user OU, and then use another GPO to set all the user-settings that the users will have, when logging in to servers in that OU. After setting it to вЂњEnabledвЂќ, on the GPO of the OU of the Citrix server, the integrator has the option of setting it to either вЂњmergeвЂќ or вЂњreplaceвЂќ mode. The key to controlling what happens is the вЂњUser Group Policy loopback processing modeвЂќ GPO setting. User settings will be read in AD first at the computer OU, but then at the user OU, and the user OU will win out if there are any conflicts, by default. But if we set a вЂњuserвЂќ GPO and put it on our one SERVER organizational unit, by default, we donвЂ™t get the guarantee that our GPO will work. In the case of the вЂњfolder redirectionвЂќ GPO, we have to configure the GPO in the вЂњuserвЂќ section, since there is no corresponding setting in the вЂњcomputerвЂќ section. In this case the Citrix integrator needs to be able to вЂњlock-downвЂќ the Citrix SERVER Organizational Unit, so that already-existing users with conflicting user settings can come in without threatening the stability of the Citrix implementation. If we are building the AD from scratch along with the Citrix implementation, we might as well create the вЂњCitrix UsersвЂќ OU but we might more likely be bringing Citrix into an AD implementation that already exists, for completely different designs than вЂњterminal servicesвЂќ, and the users already may have GPOвЂ™s controlling things like folder redirection and hiding server drives, in ways that conflict with what we need them to do. But there are a few different scenarios to look at with the users. As the Citrix integrator, we need to be able to control the type of access the users are getting when logged on to the Presentation Servers, and we use GPOвЂ™s, on an OU, to accomplish this.ДЄs far as the users, they also donвЂ™t belong in a folder, but in an Organizational Unit.

The вЂњloopback mergeвЂќ or вЂњloopback replaceвЂќ setting in group policy can be a critical component to getting the control over user access that a Citrix implementation requires:ДЇirst of all, the users donвЂ™t go in the users container, and the Citrix servers donвЂ™t go in the computers container, because they canвЂ™t be controlled with group policies instead, separate containers, вЂњOUвЂ™sвЂќ, are created by the AD administrator.ДЄt the minimum, we require a single OU for the Citrix server we are implementing.

Hide Drives on My Computer вЂ“ determines exactly which drive letters a Citrix client can see, and has to take into account the home drive, the other network drives, and the remapped client drives.

Lockdown of Internet Explorer / the Desktop (may require significant testing to make sure things arenвЂ™t too locked down to get the work done).

Folder Redirection (to keep the size of the roaming profile down and keep the userвЂ™s data centralized and secure).

(used in conjunction with two others вЂ“ вЂњ- do not detect slow connectionвЂќ and вЂњ-wait for remote profile to loadвЂќ)

Delete Cached Roaming Profile вЂ“ removes the roaming profile from the Terminal Server after the user logs off, and the changes have been successfully copied back to the central roaming profile directory.

LOOPBACK PROCESSING GPO WINDOWS

There is an Excel spreadsheet called PolicySettings.xls that is searchable, and contains detailed explanations of each setting in the default Windows 2003 SP1 templates.Д«ut there are a few key settings among all the registry keys that are critical to the success of a Citrix implementation. Windows 2003 Group Policies can do a lot of things itвЂ™s such a big list of things that you can do in a Group policy, with the default templates, that it can be difficult to find a setting among the hundreds of fields and sub-fields in the Group Policy tool in Active Directory.

Loopback processing gpo