I have my Terminal Servers (Windows 2k3) in their own OU with their own Group Policy. Loopback "merge" is enabled and everything, in general works OK.

For **Computer Configuration**, under `Policies/Administrative Templates/Windows Components/Terminal Services/Terminal Server/Remote Session Environment` I have some settings defined. In particular, "Start a program on connection" which starts the only app they need on the terminal server. Works great. When they exit the app their session ends.

However, I don't want that app to launch when I connect as a Domain Admin. In that scenario, I need the normal TS experience. I visited Delegation -> Advanced for the policy and set "Apply Group Policy" to Deny for Domain Admins. However, that only impacts the **User Config**, not the **Computer Config** (verified by gpresult) which is, upon reflected, as I'd expect (right?). 

So... what's the proper way to exclude loopback processing for a user or group?