So as we start this module, I'm going to be looking at an interesting scenario, which are the deployment
of kiosks and remote desktop services or VDI installations.
And how group policy can play in that kind of an environment.
So what I want to talk about is the challenges around these particular sorts of configurations.
For example, kiosks very usually highly locked down.
They have, you know, running a specific application or a specific use.
Like, for example, you might have a computer running windows in a public area, like a library or
an airport or someplace like that.
And you want to give access to a particular application.
Maybe it's to print your boarding pass or to do some specific activity.
So you want to give the user as little access to the system as possible.
You want to give them access to maybe a single application.
And, you know, having that kind of highly locked down configuration is something that, of course,
grew policy specializes in.
And kiosk mode in particular, or kiosks in particular are placed where group policy can really help
out.
The other scenario where we see a lot of this kind of activity is in remote desktop server implementations
or Citrix Zen app or even VDI systems where they're often systems, especially remote desktop servers
where they're being logged into by multiple users, often at the same time running particular applications.
It could be office.
It could be the browser.
It could be any number of applications and they're really all sharing a single OS in the case of remote
desktop servers or Citrix Zen app.
In the case of VDI, it's really more about sharing a single infrastructure, whether it be computer,
hard disk and memory, and you want those users to behave across all those VDI systems.
And what behav means is to perform activities in windows that don't impact other people on that same
shared infrastructure.
And you know, the other aspect of this is that they may only log into these Zs servers or these VTI
VDI servers periodically, so they may not actually be their primary machines.
They may be logging in when they're remote from the office or, you know, over a VPN or just for a
particular application.
But they need to get access to.
So these kinds of sort of special use scenarios are another area where a particular aspect of group
policy can be really helpful, and that's called loop back processing.
And all of these scenarios really have one thing in common, which is that the user's normal experience
when they're logging into their windows system is different depending upon that computer that they're
logging into.
So if I'm on my regular desktop and I go log into a kiosk machine, my experience has to be different
on that kiosk machine.
And similarly, if I'm logged into my regular desktop and I log into a remote desktop server or a Zen
app server or a VDI system, again, my user experience is likely to need to be different.
And this is where the so-called loopback processing comes into play.
And it's a special mode of group policy processing.
So what is loopback?
Well, it can be really confusing.
Whenever I try to explain it to folks, it's always a challenge to get the idea across the first time.
So I encourage you to look at this section again and again, and I'll have some demos that'll show you
sort of how it works.
But the idea is it's meant to solve this problem that you need to deliver different group policy settings
to the user depending on which machine they log into.
And really it's about categorising these special role machines.
These special types of machines like kiosks or remote desktop terminal services as loopback enabled
machines.
And when they're loopback enabled the user, when they log into that machine, they're going to get
a different set of user based group policy settings than they would get from a normal system that they're
logged into.
So let's just kind of graphically look at this, how this works.
So on the left hand side, we've got the user in blue on their regular PC.
That little cog indicates their normal user settings that they get from the GPOs that are linked to
their user account on ADD.
And their computer gets those GPOs that are linked to the computer account in ADD.
Now let's say this user goes and logs into this computer on the right, this green computer.
And this is a PC with loopback enabled.
Maybe it's a kiosk.
And it's getting its own set of computer and user GPOs.
And what happens in loopback mode is that the user then gets the settings that are specific for this
computer end user in that loopback state or on that kiosk machine.
So the users no longer getting their blue settings.
They're getting the green settings that have been delivered by the GPOs that are linked to the computer.
So this is kind of goes against all the previous discussions we've had about, you know, GPOs with
settings that are the computer settings linked to the computer object and user settings linked to the
user object.
In a case of loopback that's sort of turned on its head.
And you can have user settings that apply to a computer that's in loopback mode.
And anyone that logs into that computer that's in loopback mode will get those user settings.
So how do you enable this?
Well, it's enabled on a per computer basis and you just basically need to flip a switch on an admin
template setting on a computer that you want to enable loopback for.
And it's this policy area here under group policy.
Configure user loopback processing mode.
There's really two modes that Loopback supports.
One is called merge mode and the other is called replace mode.
Merge mode is where the user's regular policy settings that their regular user account in and gets those
are processed first when the user logs on to a kiosk or a loopback system.
And then the user settings that apply to the loopback computer are processed.
Second.
So you end up getting two sets of user policy on this kiosk or loopback system.
Now replace mode is where user settings that apply to the loopback computer are processed first and
the user's regular settings are completely ignored.
So they basically these kiosk or loopback user settings absolutely override or apply in place of the
user's regular user settings.
So let's get in and kind of dig into this a little bit and show you how this loopback processing is
configured.
And then we'll dive into some examples.