Circle Back to Loopback

re: Circle Back to Loopback

Kim Nichols — Fri, 12 Apr 2013 00:33:17 GMT

FYI - Part 2 is on the way, but I wanted to let you know that the infamous Vista loopback KB has been updated and is hopefully a little less terrible that it once was :-P

support.microsoft.com/.../en-us

re: Circle Back to Loopback

Dmitry Zobnin — Tue, 09 Apr 2013 14:43:44 GMT

+1 to gotsch-it question. Can you clarify security filter processing behavior with loopback mode enable? An article (support.microsoft.com/.../EN-US) is pretty confusing.

re: Circle Back to Loopback

Jonathan Stephens, MSFT — Mon, 11 Mar 2013 08:44:04 GMT

@Fduch

Thank you for that feedback. I'll use .PNGs for our upcoming blog post this week.

--Jonathan

re: Circle Back to Loopback

Fduch — Mon, 11 Mar 2013 07:16:45 GMT

PLEEEEEEEEEEEEEEEEEEEEEEEESE!

Can you (and all Microsoft bloggers) never EVER use jpeg format for screenshots. The images are bad and blurry and the files are bigger. Only use PNG for screenshots (and anything other than photos), please.

re: Circle Back to Loopback

alt-92_ — Sun, 10 Mar 2013 11:45:25 GMT

Kim, thanks for the heads-up about Cross-forest GP processing.

Just in time to avert major disruptions @ work.

We're currently in a migration process, running a new forest with users still in the old forest. Unfortunately the admins in the old forest have a tendency to implement unannounced untested user GPO's which we then have to work around again or even negate.

re: Circle Back to Loopback

rimetree — Wed, 06 Mar 2013 18:21:41 GMT

Thanks for the refresher. One thing I was hoping you can confirm for me is that if you have multiple policies containing user configuration settings linked to the same computer OU, only one policy linked to that OU needs to have the loopback setting configured. In that case, all user settings from all policies linked to that OU will apply to the logged on user.

Doug

re: Circle Back to Loopback

Kim Nichols — Fri, 01 Mar 2013 23:36:24 GMT

@gallwapa - Loopback replace doesn't have any effect on the processing of the client side extensions. All loopback is doing is changing the list of GPOs that are applied to the user at logon (based on the location in AD of the computer rather than the user). Once the list is obtained, processing continues normally. The only exception to this is when you are working with cross-forest group policy processing. When cross-forest policy processing is enabled, by default processing reverts to loopback replace mode. This means that user policies that are applied will come from the any GPOs in the path of the computer in the computer's domain (not the users). Things become more complicated at this point because while the GP Engine understands how to query across forests, not all client side extensions do. One extension that we are aware of that has issues with querying across forests is GPP drive maps. So in a cross-forest scenario, some CSEs may not process properly or completely.

re: Circle Back to Loopback

Chris128 — Thu, 28 Feb 2013 16:21:58 GMT

Glad to have this as a post to refer people to as I still see a lot of people not understanding this, especially the part about loopback processing affecting all GPOs and not just the one it is enabled in.

One thing that I think is worth clarifying (as it tripped me up when I first started working with loopback processing) is that when the computer processes user based GPOs due to loopback processing being enabled it does it in the logged on user's security context and not the computer's security context (i.e. Local System) as would normally be the case with computer policies. So you can still use security filtering and ACLs on the GPO to limit which users get a specific GPO applied even when that GPO is being applied via the computer using loopback processing.

re: Circle Back to Loopback

gallwapa — Fri, 22 Feb 2013 16:24:18 GMT

How are extensions such as Group Policy Preferences handled when loopback is in REPLACE mode?

re: Circle Back to Loopback

VenkatSP — Mon, 18 Feb 2013 08:33:26 GMT

Kim, Thanks a lot for taking time to explain Group Policy Loopback processing. I've learned somthing new today. Thanks to YOU.