Persona Management - GPO question

[BZatWS]

Even though this has to do with Persona Management I think this question is really for the Group Policy experts out there.

I can't seem to get Persona Management to work when I apply the GPO to an OU containing only user accounts -  the same GPO will work fine when applied to the OU containing the VM Computer's.

So far my guess is that the cause has something to do with the fact that the Persona policies are in the Computer hive which gets applied during bootup and if I assign the GPO to a User OU it is too late in the process to apply the setting.

One argument against my guess is I also have a separate GPO for Windows Folder Redirection (not Persona redirection) this is in User hive but applied to the Computer OU and this works - not exactly an apples to apples comparison.

Where I am going with this is ALL of my VM desktops are in a single OU - the single OU is my limiting factor  - I would like to send the Persona data to 2 different datastore paths based on user security group membership like student vs. faculty. 

Testing failed with the 2 GPO's applied to the Computer OU using GPO filtering to allow one group access to one GPO, I really thought filtering would work. I also tried setting loopback processing on the GPO but that appears to only effect policies on the user hive.

Anyone have any experience using Group Policies, Persona and multiple datastores??

Thanks

[marcdrinkwater]

The persona Management GPO applied to the computers.  It won't work when applied to a user OU

the folder redirection is a user setting so its applying to users logging onto machines in that OU.

i'd have thought that item level targeting would work for filtering.

[BZatWS]

I am going to setup another test using 2 GPO's on the computer OU, plus filtering and being more careful to make sure I have a valid test.

What seemed to happen with my first round of testing using filtering was the GPO never applied.

This is where all the semantics come in - to use filtering you have to delete the Authenticated user account from the GPO - Computers and users are considered authenticated users so with Authenticated user permissions set, by default,  the GPO's will apply in order of precedence based on the Computer authenticating. (I can test this more carefully too)

So now - the VM boots up - neither GPO is applied because Authenticated users do not have rights to either GPO - this makes sense -  later a user logs in - I do not think the GPO is reapplied because it is on the Computer OU and not the user OU - things never get to the point where the filtering based on user account is in play.

This is the Catch-22 I am trying to figure out and where I could use some more insight- I have to learn the sequence of when and why the GPO(s) are applied and whether or not that same GPO is reapplied.  I looked into loopback processing but that appears to only effect the user hive.  I keep thinking a solution should be simpler than what I am finding....

[marcdrinkwater]

Can't you use Item Level Targeting instead of security filtering?

[Seb1180]

Sorry to dig up that old post but I am facing the exact same scenario / issue and I was wondering if anyone came up with a solution for this.

To recap I have a multi site env and my goal is to implement PM both on physical & virtual computers with PM redirection targeting a specific folder per site.

When I remove authenticated users and replace it with Site A group containing the users of that site the PM service goes to disabled.

Any feedback would really be appreciated.

Cheers

Seb

[BZatWS]

Wow Seb,  this was an oldie.

I ended up finding a simple solution by configuring GPO's for Folder Redirection and gave up on Persona Management.  This had a few unanticipated benefits and has worked out really well for us.

The GPO is assigned to the users OU and the user hive so it has the same effect on physical and VM computers.  I redirect the desktop, My Documents, Favorites, Music, Video and Pictures to a network share.  As a test you can apply the GPO then login as the same user to a physical and VM machine.  Create desktop shortcuts or Favorites on one and see them appear immediately on the other machine.

The redirect works like a shared folder instead of like a roaming profile so it doesn't download/upload on login/logoff.  This helps reduce whatever happens during login storms and there is no roaming profile/PM to corrupt and cause users to lose data.  The redirected files live on a single network share so they are always synced.

I don't sync appdata. In our environment this turned out to be acceptable.  Without roaming profiles or PM, users are creating local profiles.  Our users login to the same 1-3 physical machines every time so after their first logins the first time user stuff goes away.  They login to random VM's so they create a new local profile/appdata every time.  We decided the extra 10 seconds it took for Word to open every time was an acceptable tradeoff for never, ever seeing a corrupted roaming profile/PM and a user never, ever losing something saved to their desktop or my documents folders. The VM's are faster so the impact of creating a local profile is much less than on our slower physical machines.

Before VM's we always had trouble with corrupted roaming profiles and I am not trashing PM but we saw a little of the same corruption in testing.  Folder redirection removed that from our daily tech lives and removed a source of great frustration from our users tech lives.

There are a lot of conditions here so I hope I explained it in a way that makes some sense.

Bruce

[Seb1180]

Thanks Bruce for your quick reply indeed on an old one googled a lot but didn't find anything except one or two posts like this one so you were the lucky winner getting a reply/question

The idea behind all this is to create a unified desktop between virtual and physical like you did. We have couple of environment where people log on to and there is a lot of demand for those "shared / redirected" folders but I need the profile to be retained at least in View.

I am not a big fan of windows roaming profiles although PM seemed a bit better and so far never had a corruption. Don't know why got s sneaky feeling it will happen soon.

Your way to do it brings me to other ideas I will start testing in my lab but I found a bit weird that no one never got this PM policy working based on a specific group ...

Cheers

Seb