I have a new RDS environment setup for a client (2008 R2). They desire to only have certain users have access to their local desktop/laptop drives while connected through RDS. From what I understand that no matter what setting you have setup in the RDP-Tcp protocol the GPO would take presecence. From what I have tested this is true. However what I cannot do is apply this GPO to only certain users. It is either blocking the ability to see remote drives when connected via RDS or it is not...for everyone. Here is what I did:
I created a new GPO that has only the "Do not allow drive redirection" set to "Enabled". I then went to the securities of this GPO and added the users, that the client wants to have access to remote drives, specifically to the securities but "Denied" the "Apply Policy". Essentially this should make the GPO apply to all users that log into this server but not the ones I specifically added. However, no matter what I do the policy applies to everyone. The policy does work because I can disable it and everyone will see their remote drives but the moment I enable it and gpupdate /force the next time they logon they cannot see their remote drives including the users I denied application of the policy. I also tried setting up loopback processing since the setting pertains to the Computer Configuration and not the User Configuration but that did not change anything with it set or not.
Any help would be appreciated.
Thanks!