AD Mystery

[alan-d]

I'm playing about with a new GPO - one setting is to disable access to properties to 'My Computer' and 'My Network Places'.

The problem is I can't seem to disable it so access is granted.

I have changed the settings in User Configuration - Administratice Templates - Desktop and forced gpupdate on the server and client but the test user still cannot access properties on either.

Another quirk that seems to happen is the error message warning that the function has been disabled appears twice.

I know it's Monday but can anyone see what I'm missing?

[Gatt]

try running gpupdate /sync on the client PC and rebooting...

[alan-d]

Thanks Gatt - tried it but no change.

[plexer]

If this is a win2k3 domain have you run the modelling wizard to see what is applied?

Ben

[alan-d]

Thanks Plexer - ran it and guess what? It's not being applied by either my test GPO or the Domain GPO.

Any more ideas?

Anyone?

Please?

Going insane here!! :?

[_Bob_]

Check the other GPO settings, you can also disable access to these properties dialogs in the Admin Templates-Control Panel bit.

[plexer]

what about checking the settings to enforce the gpo? just to see if that makes it work.

Otherwise check what other gpo's are being applied and what the settings are don't forgot the order that they are applied in makes a difference.

Ben

[Geoff]

And check the security and WMI filtering.

[alan-d]

I've checked all other GPOs linked or not and all have the feature 'not configured'.

Enforced it too - still no change.

Tried it on different PCs with different users including creating a new user in the container - still nothing.

Thanks for your input so far guys - going to sleep on it and see what happens tomorrow.

[Gatt]

Check the security settings of your GPO's and make sure the "Apply Policy" checkbox is ticked (last option IIRC) for all the users this is likely to affect (eg. Domain Users, but not Domain Admins, etc)

[kingswood]

Failing all that look on www.gpanswers.com - they have been great when I have gotten stuck on a particular Group Policy thingy...

[plexer]

If this is a multi domain controller setup are you sure dns, replication etc... is all working ok?

Ben

[alan-d]

Thanks again guys but still no luck.

I can make changes to any other part of the policy and will do as requested with no bother.

The message that comes up when my test user tries to open Properties in the My Computer icon is

"This operation has been cancelled due to restrictions in effect on this computer. Please contact your system administrator"

Great!! The policy worked - only now it's disabled and the above message still appears.

One odd thing I have noticed is that the Properties option is available for selection whether the policy is enabled or disabled.

No other Policy has this option configured, I've linked, enforced, linked and enforced to no avail.

I have gone through every setting in every GPO on the system and I can't find anywhere else that this setting is enabled or disabled.

It's not the computer as I've tried several.

DNS, replication etc are all working fine.

I'm going to give it till the end of today to find a solution afterwhich I'm going to scrap the GPO and start again from scratch and put it down to an unknown glitch.

Thanks for you input guys.

[plexer]

Ok what are the clients XP or 2K? if XP what style of desktop do they have classic or telletubies? just wondering if anything there could cause a problem.

Ben

[alan-d]

lol - I think I'm turning into a Teletubby

Server 2003 and Win XP SP2.

It's definately something to do with that particular GPO - I just replace it with a new one - changed the one setting, updated and logged in as the test user - it worked fine.

Looks like it' back to step one

Wibble!!!!!