Am I doing something wrong?

[PreviousPoster]

Hello, I have a group policy to end idle terminal serivce sessions after 15 minutes. The policy is on the OU which contains the servers so that anyone who logs into these servers gets this 15 minute rule.

Now I would like to add a small group of people who's timeout limit I want to be 3 hours. So i created a new OU, added these users to it, and applied a NEW group policy with the timeout of 3 hours, but this will not override the GP on the OU with the servers in it for 15 minutes.

How can I accomplish this?

Thank You,
Adam

Deeper down OUs have higher prescedence than higher OUs.

Based on your description, I'm not sure I see that's what you're doing.

[Hypocrisy]

if the 15 minute rule is in its own GPO and the 3 hour rule is in ITS own GPO you can deny read/apply group policy to that 3 hour group on the 15 minute rule.

although I've seen issues with terminal servers/citrix servers when you try to control the user sessions with a GPO they don't always work the way you want them to. I always set the basic settings in the ICA connection settings on each server (the longest open window) and then try to do the more restrictive settings with GPO's so if they don't work, then the machine set ones do.