Normally user settings follow the user. Loopback turns that around: the PC's location decides which user settings apply. It is the correct answer for kiosks, training rooms and shared PCs — and a confusing mess if switched on without understanding its two modes.
Picture the training room. Fifteen PCs, one shared desktop, no personal drives, no wallpaper changes, everything locked down — whoever logs on, including the manager whose normal desktop is wide open. Normal Group Policy cannot do this, because user settings follow the user account, not the machine. Loopback processing is the designed exception: it tells the PC, “for anyone who logs on here, take the user settings from my GPOs.” It lives in the computer half: Computer Configuration → Administrative Templates → System → Group Policy → Configure user Group Policy loopback processing mode.
Example — with loopback, the PC's OU decides the user experience for everyone who logs on to that PC.
In Replace mode, the user's own GPOs are not processed at all on that PC. Instead, the user settings inside the computer's GPOs are applied as if they were the user's. The PC completely defines the desktop. This is the mode for true kiosks, exam machines, training rooms, reception PCs and factory-floor terminals — anywhere the experience must be identical for every human who touches the keyboard.
The honest warning: Replace is total. If the computer's GPOs do not define a setting the user needs — a drive mapping, a printer — it will not be there, because the user's own GPOs never ran. Test with a real user account, not just an admin account, before rolling it out.
In Merge mode, the user's normal GPOs process first, as usual. Then the user settings from the computer's GPOs process again, on top — and where they conflict, the computer's version wins. The user keeps their personal environment except where the PC's location deliberately overrules it.
Merge fits shared-but-personal spaces: a hot-desk area where staff keep their drives and mail but the local printer and a stricter screen lock come from the room's GPOs. It is gentler than Replace, and gentler means easier to get subtly wrong — a setting you expected the PC to enforce can be missing simply because the computer's GPO never defined it, so the user's value survived.
Loopback is a computer setting, so the GPO containing it must be linked to the OU holding the computer accounts — the training-room PCs, not the trainees. The user settings that loopback will deliver must be in GPOs linked to that same computer OU (often the very same GPO). Two traps catch everyone once:
After enabling loopback, the PC needs a restart (it is a computer-side behaviour) before the new logic takes over.
Loopback is a specialist tool, and most offices need it on a handful of PCs at most. Do not enable it domain-wide or on ordinary staff PCs: it makes every GPO question harder ("whose settings? which mode?") and it famously confuses troubleshooting months later, when a user's settings "ignore" their OU for reasons nobody remembers. If your goal is simply "this department's users get X", a normal user GPO on the users' OU does it — no loopback. Reach for loopback only when the sentence starts with "anyone who logs on to THESE machines…"
Servers deserve a mention: loopback (usually Replace) is standard practice on Remote Desktop Session Hosts, so users get a controlled session desktop instead of their full office environment. Same tool, same reasoning — the machine defines the session.
gpresult /h report.html — the report shows the loopback result plainly.Only when the test PC behaves exactly as designed should the rest of the room join the OU.
User policy and computer policy explained live on a real domain controller — create, link and test your first GPO with the video.
▶️ Watch Full VideoIn Replace mode the user's own GPOs are skipped entirely and the user settings from the computer's GPOs are used instead. In Merge mode the user's GPOs apply first, then the computer's user settings apply on top and win any conflict.
In GPOs linked to the OU that contains the computer accounts — often the same GPO where loopback itself is enabled. Loopback never reads user settings from GPOs linked to the users' own OU.
Yes. Loopback is a computer-side processing behaviour, so restart the PC after enabling it. Then test by logging on with a normal user account and checking gpresult to confirm the expected GPOs delivered the user settings.