MCITP 70-640: Group Policy Loopback Processing

Loopback processing allows the administrator to apply user Group Policy settings based on where the computer accounts are located rather than basing it on the user account. This is an invaluable setting to use when deploying kiosk computers where you do not want the user settings to be applied.

Loopback Processing
Loopback processing changes the algorithm used to apply Group Policy to a computer. This allows the administrator to effectively ignore or merge the user configuration that would be normally applied to the computer.

Group Policy Normal Processing
Group Policy is divided into two halves, Computer Configuration and User Configuration. Group Policy loopback processing changes the way these two halves are applied and where the settings are obtained from.

Without Loopback Processing enabled, when the computer starts up, Computer Configuration from Group Policy is applied. This is applied based on where the computer account is located in Active Directory. User configuration is applied when a user logs in based on where the user account is located in Active Directory.

Group Policy Loopback Processing (Replace)
When Computer Configuration is applied to the computer, there is a setting in computer configuration that will enable Group Policy Loopback Processing for replace mode. When enabled, this will change how user configuration is applied. Instead of user configuration being applied based on where the user account is in Active Directory, user settings are applied based on where the computer account is located in Active Directory.

Demonstration
Loopback processing is configured via the following setting.
Computer Configuration\Polices\Administrative Templates\System\Group Policy\User Group Policy loopback processing mode
This setting can be configured for merge or replace mode. Merge mode is explained below.
Group Policy Loopback Merge
When Merge mode is enabled, Group Policy is first applied like it would be normally. That is, the computer configuration based on where the computer account is located in Active Directory and user configuration based on where the user account is located in Active Directory is applied. The difference is that an extra step is added. The extra step applies user configuration based on where the computer account is located in Active Directory. This is often used for Remote Desktop Services where you want the user to have their user settings applied, but want the option to override or add additional settings as required.

References
"MCTS 70-640 Configuring Windows Server 2008 Active Directory Second edition" pg 294 -- 295

[itfreetraining]

If your luck to work for such a company you will never forget the feeling when you first walk into one of these massive server rooms for the first time. Thanks for sharing you experience. I am sure the people who are just starting out appreciate it who have not looked after such big networks.

[tiri]

After 7 years still usefull. Congratulations!! it is the best and clearest explanation that I have seen and thanks for your videos.

[itfreetraining]

The course is not quite finished as yet, are working on certificates at the moment and that will be released next. Good to hear that you like the videos.

[itfreetraining]

Thanks for your comments on this video. They are excellent and very accurate. I am sure those that read them will benefit.

[skycoolmiles]

Great video with clear and easy explanation. Every time it comes to Loopback processing I had to refresh my memory on Replace and Merge modes. THANK YOU!

[marklord]

This video is still paying dividens. Thank you so much!

[shmueles]

Years after finished my exams, ran into this...very good explanation! Thanks

[itfreetraining]

Thanks for you feedback. We will redo the video for Server 2012. I believe adding some additional animations will make it easier to understand.

[MattRoadhouse]

Indeed. Most places you will never 'touch' as many technologies as working for an entire Health Region. (2 data centers, 3 primary sites and 25 or so long term care facilities/clinics and rural hospitals, 5000~ computers and a Hyper V cluster)

As hard as it it, you are very accurate in saying its a rare experience. Most large private companies will have you only administrate one small piece :)

[nefariou]

So glad I discovered this video and channel. Got my 70-685 exam coming up, and these videos are extremely helpful.

[FranciscoFernandesJr]

Hi, I would like to thank you for such a great explanation on GP loop back processing. This is the first time I really got it. Thank you very much for such hardworking.

[hapeedays]

Ive been to a few sites to understand loopback policy, but this video finally sank in!! Excellent post.

[georgibg]

Again, I have to extend my thanks to you for relieving me of my frustration and confusion with this, admittedly, perplexing concept. You are doing a terrific job at presenting difficult concepts in an understandable format. Keep up the good work!

[CAMELTOESURPRIZEE]

a standing ovation i just subscribed .. I like the way you do your teaching.. Better than cbt nuggets .. :) very appreciated.. you help me solve a issue at work ... :D

[gjkristi]

This is just great. This topic was very hard to comprehend, but now i fully understand how it works. All in just 11 minutes. Thank you very much :)

[stish]

there are too much video on this topic about 30 minutes but i'm not able to understand
Thank to you finally i understand that hard topic in just 10 minutes

[itfreetraining]

Could not say why Microsoft did this. The only reason that I can think of is that they did not want conflicting settings between the computer side and computer side. However, with Group Policy Preferences a lot of the settings are double up so in theory it should be possible.

[paritoshd]

Excellent explanation, easily understood in one go.

[hillsedge]

You really made it easy to understand, thank you Sir! Appreciate very much what you do.

[kishoresahu]

thanks it free training i was confused a lot in this concept glad you were the only one who solved this issue. thanks once again