AD Mystery

[alan-d]

I'm playing about with a new GPO - one setting is to disable access to properties to 'My Computer' and 'My Network Places'.

 

The problem is I can't seem to disable it so access is granted.

 

I have changed the settings in User Configuration - Administratice Templates - Desktop and forced gpupdate on the server and client but the test user still cannot access properties on either.

 

Another quirk that seems to happen is the error message warning that the function has been disabled appears twice.

 

I know it's Monday but can anyone see what I'm missing?

[Gatt]

try running gpupdate /sync on the client PC and rebooting...

[alan-d]

Thanks Gatt - tried it but no change.

[plexer]

If this is a win2k3 domain have you run the modelling wizard to see what is applied?

 

Ben

[alan-d]

Thanks Plexer - ran it and guess what? It's not being applied by either my test GPO or the Domain GPO.

 

Any more ideas?

 

Anyone?

 

Please?

 

Going insane here!! :?

[_Bob_]

Check the other GPO settings, you can also disable access to these properties dialogs in the Admin Templates-Control Panel bit.

[plexer]

what about checking the settings to enforce the gpo? just to see if that makes it work.

 

Otherwise check what other gpo's are being applied and what the settings are don't forgot the order that they are applied in makes a difference.

 

Ben

[Geoff]

And check the security and WMI filtering.

[alan-d]

I've checked all other GPOs linked or not and all have the feature 'not configured'.

 

Enforced it too - still no change.

 

Tried it on different PCs with different users including creating a new user in the container - still nothing.

 

Thanks for your input so far guys - going to sleep on it and see what happens tomorrow.

[Gatt]

Check the security settings of your GPO's and make sure the "Apply Policy" checkbox is ticked (last option IIRC) for all the users this is likely to affect (eg. Domain Users, but not Domain Admins, etc)

[kingswood]

Failing all that look on http://www.gpanswers.com - they have been great when I have gotten stuck on a particular Group Policy thingy...

[plexer]

If this is a multi domain controller setup are you sure dns, replication etc... is all working ok?

 

Ben

[alan-d]

Thanks again guys but still no luck.

 

I can make changes to any other part of the policy and will do as requested with no bother.

 

The message that comes up when my test user tries to open Properties in the My Computer icon is

 

"This operation has been cancelled due to restrictions in effect on this computer. Please contact your system administrator"

 

Great!! The policy worked - only now it's disabled and the above message still appears.

 

One odd thing I have noticed is that the Properties option is available for selection whether the policy is enabled or disabled.

 

No other Policy has this option configured, I've linked, enforced, linked and enforced to no avail.

 

I have gone through every setting in every GPO on the system and I can't find anywhere else that this setting is enabled or disabled.

 

It's not the computer as I've tried several.

 

DNS, replication etc are all working fine.

 

I'm going to give it till the end of today to find a solution afterwhich I'm going to scrap the GPO and start again from scratch and put it down to an unknown glitch.

 

Thanks for you input guys.

[plexer]

Ok what are the clients XP or 2K? if XP what style of desktop do they have classic or telletubies? just wondering if anything there could cause a problem.

 

Ben

[alan-d]

lol - I think I'm turning into a Teletubby

 

Server 2003 and Win XP SP2.

 

It's definately something to do with that particular GPO - I just replace it with a new one - changed the one setting, updated and logged in as the test user - it worked fine.

 

Looks like it' back to step one

 

Wibble!!!!!

[_Bob_]

Have you tried specifically setting the policy to disabled? Just to rule out the client caching and not overwriting the older setting or somthing silly like that? Failing that i think i'd be tempted to scrap it and start again as you say.

:?

[alan-d]

Yep - tried that as well as a load of other suggestions from here and other forums etc.

 

2 Days trying to figure it out - It's now got to the point where starting again is the only sensible option as far as time spent goes.

 

Mind you - if it happens again - at least I'll know it's something I did and not a glitch somewhere

[plexer]

Have to say I just modelled this on my test OU with the remove properties from my computer option enabled and it was ok.

 

Ben

[Gatt]

lol - I think I'm turning into a Teletubby

 

Server 2003 and Win XP SP2.

 

It's definately something to do with that particular GPO - I just replace it with a new one - changed the one setting, updated and logged in as the test user - it worked fine.

 

Looks like it' back to step one

 

Wibble!!!!!

 

Have you upgraded Win2k3 to SP1?? Cos I had a few problems with GPO not going across to Service Pack 2 Clients till Win2k3 had SP1 installed

[alan-d]

Yep we have SP1 installed.

 

It has to be the GPO itself and those particular settings as all other settings work fine if changed.