I have associated loopback policy to this container , then it works. But I would it associate no to all workstations , but only certain group of workstations. If I remove "authenticated users" from APPLY GPO and then assign apply rights only to this WS group, the user setting do not apply, because it is not user group. On this computers work more users, therefore is for me more simply assign policy to WS group that users group. I would like avoid to create next subcontainer and associate policy to this. Exist some solution for this ?