Phantom policy!

[Sheridan]

Some of our recently imaged PCs are logging an error (which relates to login scripts running) that seems to show that a group policy is preventing access to the cmd.exe:

 

Access to C:\Windows\System32\cmd.exe has been restricted by your Administrator by location with policy rule {GUID} placed on path C:\Windows\system32\cmd.exe.

 

Now, the weird thing is that GUID does not link to any Group Policy in our organisation, and I can't find a reference to it on the local machine! Its only on a certain batch of PCs which were created with the same image, but I can't find a trace of that phantom guid anywhere!

 

Anyone got any ideas where this could be hiding?

[sted]

its not a local gp rather than a network gp?

[Sheridan]

I can't see any local GPO's! The GroupPolicy folder is empty on the local machine as well.

[3s-gtech]

Does the GUID still exist in the sysvol policies folder?

[Sheridan]

No, its not a valid policy GUID as far as I can see on both the AD servers and the local clients themselves.

[Cache]

rsop.msc run as administrator should give you a list of all the policies and their linked OU's/locations and you might be able to work it out from there?

 

I had a few machines, not newly built mind you, which were pulling an old GPO I removed a month or 2 earlier at one point for some unknown reason. Runnning gpupdate /force fixed that though.