Unfortunately there are some differences between the GPO templates included with 2012 R2 and the GPO templates included with Windows 8.1/10. The deny entry is only needed on the Lockdown GPO.
For the other two GPOs, add Citrix Admins with Edit Settings permission. If desired, you can also deny the GPO to Domain Admins and Enterprise Admins. For Citrix Admins, place a check mark in the Deny column in the Apply Group Policy row. Then on the Delegation tab click Advanced. Change the Permissions to Edit settings and click OK. Find your Citrix Admins group and click OK. On the right, switch to the Delegation tab and click Add. 
Click the Citrix VDA Non-Admin Users GPO to highlight it. Modify the properties of both of these GPOs and disable the Computer Configuration portion of the GPO. One of the GPOs is called Citrix VDA All Users (including admins) and the other is called Citrix VDA Non-Admin Users (lockdown). Create and link two new GPOs to the VDA OU (in addition to the Citrix VDA Computer Settings GPO). Modify the properties of the GPO, on the Details tab, so that the User Configuration portion of the GPO is disabled. Or you can link it to Delivery Group-specific sub-OUs. 
If this policy should apply to all Delivery Groups then link it to the parent OU. Within Group Policy Management Console, create a Group Policy Object (GPO) called Citrix VDA Computer Settings and link it to the OU created in step 1.Move the VDAs from the Computers container to one of the OUs created in step 2.Then create sub-OUs, one for each delivery group.Within Active Directory Users and Computers, create a parent Organizational Unit (OU) to hold all VDA computer objects.
0 kommentar(er)
