GPO not applying

[sippo]

I have put in a Ctrl, Alt and Delete GPO so that users can see the Code of conduct before logging in. This has applied to some managed PC's but not all. I have tried a GPupdate force, but still nothing. It says it has applied the policy, but it hasn't.

Is there a local service that needs to be started. It seems as if the local policy is over-riding the network one.

[Ric_]

Use GPMC (Group Policy Management Console) to run a GP Results report. This should tell you why the GPO hasn't applied. There will undoubtably be an error in the logs about it.

[dbsocs08]

Same as Ric_, but also try running the RSOP snap-in on the machines that aren't working, at least then you'll be able to see what is being applied by GPO and then check the events to watch for errors.

[dtakias]

I have put in a Ctrl, Alt and Delete GPO so that users can see the Code of conduct before logging in. This has applied to some managed PC's but not all. I have tried a GPupdate force, but still nothing. It says it has applied the policy, but it hasn't.

Is there a local service that needs to be started. It seems as if the local policy is over-riding the network one.

It should work for every PC that is managed by the domain, as the domain policy takes priority over the local one. Obviously this entry should be disabled or 0 otherwise LegalNoticeCaption and LegalNoticeText will not work.

Also try running rsop.msc on the PCs that fail to pick up the policy just after you are logged on the domain. That should tell you if the policy has been applied locally

[sippo]

Use GPMC (Group Policy Management Console) to run a GP Results report. This should tell you why the GPO hasn't applied. There will undoubtably be an error in the logs about it.

How do I do this??

Is it on the server or local client?

[dtakias]

How do I do this??

Is it on the server or local client?

It's on the server. I think this is what he means...

[sippo]

See I've done a gpresult on a client pc, it says it has been applied but you can clearly see it hasn't.

[Nick_Parker]

I have put in a Ctrl, Alt and Delete GPO so that users can see the Code of conduct before logging in. This has applied to some managed PC's but not all. I have tried a GPupdate force, but still nothing. It says it has applied the policy, but it hasn't.

Is there a local service that needs to be started. It seems as if the local policy is over-riding the network one.

We had a problem with GP applying because we had a 2nd Domain Controller (as a backup) and it was somehow taking control, but didn't have the logon scripts available.

Just out of interest, how are you doing the Code of Conduct??
I'm looking for a way of doing it @ our college

[sippo]

Nick we have a 2nd domain controller aswell, but how did you realise 'it was taking over'?

As for the code of conduct, its just something I wipped up. I'll see if I can dig out an electronic copy.

[dbsocs08]

Have you created a new GPO or added it to an existing one?

[sippo]

At first I put in a existing one which didn't work, then I created a new one.

[dbsocs08]

OK mate, no worries, didn't wanna sound patronizing about checking that the new GPO is assigned to all machines, created under a stations OU?

[sippo]

All the PC's are in the same OU folder.

[dbsocs08]

have you tried running the rsop snap in on the client machine, I know the GPO results showed that it had applied, but obviously it hasn't. If you run that you can see exactly what is being applied to the machine.

[Gatt]

There's a reg hack for the issue of 2 DCs - something to do with DC priorities...

linky 1 - LdapSrvWeight

Linky 2 - LdapSrvPriority

Had this issue myself - only noticed cos of my KiX scripts!