+ Post New Thread
Results 1 to 12 of 12
Windows Server 2008 R2 Thread, Group Policy: There, Yet Not Applying in Technical; Hi folks, I'm struggling to understand what's happening with a group policy... I'm applying a GP to change the way ...
  1. #1
    Gongalong's Avatar
    Join Date
    Oct 2011
    Location
    United Kingdom
    Posts
    920
    Thank Post
    836
    Thanked 20 Times in 18 Posts
    Rep Power
    11

    Question Group Policy: There, Yet Not Applying

    Hi folks,

    I'm struggling to understand what's happening with a group policy...

    I'm applying a GP to change the way Internet Explorer connects. I've made a couple of modifications to the policy, and am now testing to see if it has applied.

    On the test PC, IE's LAN settings were previously set manually. After logging in, and even after forcing a GPUPDATE, the modifications to the policy have not applied.

    If I use RSOP.MSC it shows the settings as per the policy (!).

    Anyone know if this is something peculiar to LAN settings e.g. if set manually they cannot be altered by a policy?

    TIA

  2. #2

    synaesthesia's Avatar
    Join Date
    Jan 2009
    Location
    Northamptonshire
    Posts
    6,219
    Thank Post
    601
    Thanked 1,089 Times in 837 Posts
    Blog Entries
    15
    Rep Power
    485
    What do you get in gpresult /r ? (run it in an elevated command prompt to ensure the right result)

  3. Thanks to synaesthesia from:

    Gongalong (26th June 2012)

  4. #3

    Join Date
    Jan 2008
    Location
    South West
    Posts
    1,819
    Thank Post
    217
    Thanked 266 Times in 216 Posts
    Rep Power
    68
    is your test PC in a valid OU? not just a container. This stopped some proxy settings working despite that GP settings being for users.

  5. Thanks to chazzy2501 from:

    Gongalong (26th June 2012)

  6. #4
    ricki's Avatar
    Join Date
    Jul 2005
    Location
    uk
    Posts
    1,475
    Thank Post
    20
    Thanked 164 Times in 157 Posts
    Rep Power
    52
    Have you got the correct adm for the version of ie?

    Richard

  7. Thanks to ricki from:

    Gongalong (26th June 2012)

  8. #5

    Join Date
    May 2011
    Location
    Jus North of London, close but not too close
    Posts
    851
    Thank Post
    188
    Thanked 70 Times in 65 Posts
    Rep Power
    50
    Try and run gpresult /h [path to file] from a command prompt for a computer/user that should get the policy setting

    i.e. gpresult /h c:\gpresults\test.html

    Double click on the file once it has completed and browse down to the Internet it should show you the winning GPO policy for the settings and what the settings are for Internet Explorer maintenance.

  9. Thanks to Davit2005 from:

    Gongalong (26th June 2012)

  10. #6
    Gongalong's Avatar
    Join Date
    Oct 2011
    Location
    United Kingdom
    Posts
    920
    Thank Post
    836
    Thanked 20 Times in 18 Posts
    Rep Power
    11
    synaesthesia/Davit2005: GPRESULT shows the same thing as RSOP.MSC, that is the policy settings are there, but not actually applied to Internet Explorer. My guess is that altering the settings manually on the PC then causes the system to stay with those, despite what the policy is set to. Annoying, but it seems to be consistent at least.

    chazzy2501: the policy's being applied to user (IE settings only seem to be under the user section), but in any event the users are in a shared folder, not an OU (a historic issue, which I'm debating whether to change). The policy itself is set to apply to all authenticated users, and as per the above it is actually appearing on the PC.

    ricki: ADM?... Administrative Templates?

  11. #7

    Join Date
    Dec 2011
    Location
    Bakersfield
    Posts
    14
    Thank Post
    4
    Thanked 4 Times in 3 Posts
    Rep Power
    6
    cmd > gpresult /V > C:\gpresult.txt

    Post the results

  12. Thanks to zlorimer from:

    Gongalong (27th June 2012)

  13. #8
    bart21's Avatar
    Join Date
    Aug 2009
    Location
    peterborough
    Posts
    405
    Thank Post
    79
    Thanked 54 Times in 52 Posts
    Rep Power
    20
    are u applying the settings as a user or computer policy?

    if a user policy on a computer ou you will need loopback enabled.

    nick

  14. Thanks to bart21 from:

    Gongalong (27th June 2012)

  15. #9
    Gongalong's Avatar
    Join Date
    Oct 2011
    Location
    United Kingdom
    Posts
    920
    Thank Post
    836
    Thanked 20 Times in 18 Posts
    Rep Power
    11
    bart21: it's a user policy, because you can only set these particular IE settings via that as far as I can see. I'm not familiar with loopback, but as per below some of the settings are definitely being applied.

    zlorimer: unless I'm missing something the results via HTML and TXT file seem to conflict.

    Here's a screen capture of what the HTML version says is happening for IE connections. Image - TinyPic - Free Image Hosting, Photo Sharing & Video Hosting

    Here's what seems to be the relevant portion of the TXT file, where all the policies seem to be denied. This can't be the case though as part of the user settings are some scripts that map drives, and those drives are being mapped. That's aside from some UI changes that are also definitely being effected:

    USER SETTINGS
    --------------
    CN=Administrator,CN=Users,DC=admin,DC=school,DC=lo cal
    Last time Group Policy was applied: 25/06/2012 at 13:00:58
    Group Policy was applied from: VA-DC1.admin.school.local
    Group Policy slow link threshold: 500 kbps
    Domain Name: ADMIN
    Domain Type: Windows 2000

    Applied Group Policy Objects
    -----------------------------
    Default Domain Policy

    The following GPOs were not applied because they were filtered out
    -------------------------------------------------------------------
    Admin PCs Deploy
    Filtering: Denied (Security)

    Admin PCs
    Filtering: Denied (Security)

    ITS PCs Deploy Test
    Filtering: Denied (Security)

    WSUS Policy Admin PCs
    Filtering: Denied (Security)

    Admin Users
    Filtering: Denied (Security)

    NetOps
    Filtering: Denied (Security)

    WSUS Policy ITS PCs
    Filtering: Denied (Security)

    Teaching Staff
    Filtering: Denied (Security)

    Local Group Policy
    Filtering: Not Applied (Empty)

    The user is a part of the following security groups
    ---------------------------------------------------
    Domain Users
    Everyone
    BUILTIN\Users
    BUILTIN\Administrators
    NT AUTHORITY\INTERACTIVE
    CONSOLE LOGON
    NT AUTHORITY\Authenticated Users
    This Organization
    LOCAL
    Domain Admins
    Group Policy Creator Owners
    SophosUser
    SophosAdministrator
    Denied RODC Password Replication Group
    SophosPowerUser
    High Mandatory Level

    The user has the following security privileges
    ----------------------------------------------

    Bypass traverse checking
    Shut down the system
    Remove computer from docking station
    Increase a process working set
    Change the time zone
    Manage auditing and security log
    Back up files and directories
    Restore files and directories
    Change the system time
    Force shutdown from a remote system
    Take ownership of files or other objects
    Debug programs
    Modify firmware environment values
    Profile system performance
    Profile single process
    Increase scheduling priority
    Load and unload device drivers
    Create a pagefile
    Adjust memory quotas for a process
    Perform volume maintenance tasks
    Impersonate a client after authentication
    Create global objects
    Create symbolic links

    Resultant Set Of Policies for User
    -----------------------------------

    Software Installations
    ----------------------
    N/A

    Logon Scripts
    -------------
    N/A

    Logoff Scripts
    --------------
    N/A

    Public Key Policies
    -------------------
    N/A

    Administrative Templates
    ------------------------
    N/A

    Folder Redirection
    ------------------
    N/A

    Internet Explorer Browser User Interface
    ----------------------------------------
    N/A

    Internet Explorer Connection
    ----------------------------
    N/A

    Internet Explorer URLs
    ----------------------
    N/A

    Internet Explorer Security
    --------------------------
    N/A

    Internet Explorer Programs
    --------------------------
    N/A

  16. #10
    bart21's Avatar
    Join Date
    Aug 2009
    Location
    peterborough
    Posts
    405
    Thank Post
    79
    Thanked 54 Times in 52 Posts
    Rep Power
    20
    look here re loopback Loopback processing of Group Policy

    have you checked read permissions on the gpo?

    nick

  17. Thanks to bart21 from:

    Gongalong (27th June 2012)

  18. #11

    Join Date
    Jan 2008
    Location
    South West
    Posts
    1,819
    Thank Post
    217
    Thanked 266 Times in 216 Posts
    Rep Power
    68
    Quote Originally Posted by Gongalong View Post

    chazzy2501: the policy's being applied to user (IE settings only seem to be under the user section), but in any event the users are in a shared folder, not an OU (a historic issue, which I'm debating whether to change). The policy itself is set to apply to all authenticated users, and as per the above it is actually appearing on the PC.

    Yes this is what was happening to me, the USER settings for IE were not being applied because my COMPUTER was not in a valid OU but a container. This only seemed to affect IEs settings (Proxy, URLs, ECT)

  19. Thanks to chazzy2501 from:

    Gongalong (27th June 2012)

  20. #12
    Gongalong's Avatar
    Join Date
    Oct 2011
    Location
    United Kingdom
    Posts
    920
    Thank Post
    836
    Thanked 20 Times in 18 Posts
    Rep Power
    11
    bart21: Thanks.

    "Authenticated Users" have read permissions.

    chazzy2501: I might go the OU route if this becomes desperate!

SHARE:
+ Post New Thread

Similar Threads

  1. Group Policy Problem - Filtering: Not Applied (empty)
    By FN-GM in forum Windows Server 2008 R2
    Replies: 32
    Last Post: 23rd October 2012, 11:36 PM
  2. Group Policy Screen Saver Not Working
    By FN-GM in forum Windows 7
    Replies: 9
    Last Post: 25th April 2012, 10:04 AM
  3. Replies: 2
    Last Post: 24th November 2011, 09:14 AM
  4. Replies: 22
    Last Post: 19th March 2008, 09:56 AM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •