How to apply group policy to users from a trusted domain

Question

Is there any way to specify a Group Policy only for the users who are members of a trusted active directory domain?

Solution

Any user policy that applies to them is going to come out of the domain their account is a member of, unless you're overriding user policy processing with loopback policy processing.

Computer policy is going to come from the domain that the computer they are logging-on to is a member of.

Are you thinking something like this? "When one of these users from domain ABC logs-on to one of the computers that is a member of domain XYZ I'd like to have certain group policy settings apply. When an ABC user logs-on to an ABC computer, though, I don't want those settings to apply. When an XYZ user logs-on to an XYZ computer, I don't want those settings to apply either."

If so, then there's no way with simple group policy to do what you're describing. You could mimic the functions of group policy with a script that checked the logon domain of the user, but running such a script in the context of the user would not permit changes to computer-specific settings.

Let me know how off-target I am with what you're asking, and I'll edit to answer your real question... (smile)

Comments

[ThatGraemeGuy]

I think you're right on the money. Group Policy cannot cross domain boundaries, even in the same forest AFAIK.

[NimsDotNet]

Yes Evan, you have described exactly what I am trying to accomplish! too bad I can't do it with group policy: :(