Group Policy not filtering down

[manick]

Hi all,

Wondered if any of you have any ideas about the following. I have created a GPO for students with all the necessary lock downs tweaks etc. However, using a test account, it is not filtering to all machines that I log onto. Those machines that it has not filtered onto, using the test account, I can get into the group policy and notice that some of the policies are not even listed nevermind set. Any idea why this would be?

Cheers

Manick

[djm968]

Try a GPUPDATE /force from the command promt, reboot and check any errors in the event logs.

[manick]

Sorry, shoulda said, already done that but no errors!! Flummoxed
manick

[Disease]

Install Gp Management console on the server then run a test from there and it will tell you if the correct GP is being applied.

It could be that the default domain policy is being applied unless you block inheritance of it.

GP Management Console will tell you for sure.

[Geoff]

Also check for any WMI or Security Filters.

[djm968]

Also try running rsop.msc on the workstation.

[Disease]

rsop.msc will only show you the policy for the currently logged on pc and the machine though. you would be unlikely to be able to run this while on a student account as the run command should be disabled so you will be unable to check wether the student accounts get the correct policy applied.

The best route for all Group Policy needs is Group Policy Management Snap in.

[manick]

Lo again,

Right, first, thanks for the replies, however, looked at the tests etc and the following is the results.

inheritance isn't blocked

when trying to run the group policy results wizard, i get the following error:

"Failed to connect to [pc] due to error listed below. Ensure that the WMI service is enabled on the target computer and consult the event log for further details.

The RPC server is unavailable."

WMI is enabled, nothing out of the ordinary in Event Viewer, rpc is running on the local machine.

Any ideas (again???)

many thanks

manick

[djm968]

Running rsop.msc as an admin user on a client will indicate if the group policy infrastructure is failing for the user or computer configuration components. It also gives a good indication that DNS is configured correctly on the client, which would be my next suggestion.

Can you ping the DC using the FQDN?

[manick]

lo,

Logged on as student can ping dc using FQDN, also rsop shows that computer config isn't applying correctly.

What does that point to then???

Thanks

manick

[djm968]

Right click the properties of computer configuration, click the error information tab and post the results.

Re-joining the client to the domain may resolve the issue though, and sometimes this is quicker than diagnosing GPO issues.

[manick]

OK with your help, we are slowly getting there!

No errors but pupil group policy isn't being picked up at all for computer config, I can't understand this though as about half of our machines are picking it up!?

In security filtering, only authenticated users is listed, does it need the computer groups in there as well?

thanks

Manick

[djm968]

I certainly won't hurt to put them in there but GPRESULT would normally indicate that the computer settings have been filtered out.

Have you tried running GPRESULT on the client?

[manick]

This is the result of gpresult on the client machine (logged in as student, co they can do everything at the mo!!!)

Computer config:
Appied group policy objects:
IS THE PUPILS ONE SUPPOSED TO BE HERE, IF SO IT ISN'T!
other policies are

User Config:
Applied group policy objects:
pupils
and others

The following GPOs were not applied because they were filtered out :

Local group policy
filtering. not applied (empty)


Thanks

Manick

[djm968]

Yes if you have configured settings in the computer configuration for the GPO it should be there.

Check the GPO on the DC again, if you haven't already do so, install the Group Policy Management Console on the server

You can run the Group Policy Management Console by typing gpmc.msc

In GPMC expand "Group Policy Objects" click on the GPO and check the scope

Right click the GPO and check the status and make sure the Computer Configuration Setings are not disabled.

Click the OU where the GPO is linked and check that the GPO is linked and also check the Group Policy Inheritance