There is quite a bit of information to keep track of in the Group Policy world. You have the four tiers of GP processing (local/site/domain/OU), then the two different sets of policy settings available inside GPME (User Configuration settings versus Computer Configuration settings)—we haven't even discussed Group Policy Preferences yet—and then all of our Scopes, Links, Security Filters, WMI Filters—the list goes on and on. So, we may as well throw one more wrench into the mix, this thing called Group Policy Loopback Processing.

Loopback Processing is essentially the act of getting User Configuration settings to apply to Computer accounts. Wait a minute, that goes against everything we have learned so far, doesn't it?! Yes. To this point, we have spoken over and over about keeping User settings inside GPOs that are going to be linked to OUs where user accounts reside, and making sure that Computer Configuration settings are inside GPOs that will filter down only to workstation accounts. This makes sense. The problem is that common sense doesn't always fit exactly what we need to accomplish in our environments.

Occasionally, you may want to restrict numerous user settings on a certain set of computers. This is no big deal, you could just create a GPO that has all of your User Configuration settings, and apply it to the users who are going to log into those computers, right? Except what if ALL of your users have the ability to log into those computers? It is most likely that your user accounts are scattered into OUs all across Active Directory, so to ensure those user settings made their way on to these computers, you would have to do a whole lot of linking. Additionally, linking these settings to the user OUs would mean these users would receive the settings wherever they logged in (including their own desktops), and maybe that is not actually what you want.

The real-world situations this is describing are things such as kiosk workstations, maybe public computers that sit out in a lobby for anyone to walk up and utilize. Most often, I see Loopback Policy Processing being used with RDS (Terminal Services) environments. These are prime examples of systems where many, many different user accounts are going to be logged in. It is very common to have more restrictive settings in place for those users inside their RDS session than on their normal desktop computers. Loopback processing gives you the ability to create these locked-down user-configuration GPOs and push them into place on certain workstations, no matter which users are logging into those workstations. In other words, Group Policy Loopback Processing is for specialized computers that you want to treat differently than traditional workstations.