Group Policy not applying

[Maximus]

Hi all,

 

I've set up AD so that we have an OU called 'School'. Original I know but what the hell!! :oP

 

I've created a new policy for internet settings and linked it to the School OU but the settings aren't being applied. However if i modify the default domain policy it works! The user i log on as is in the School OU so the settings should be applied! Does anyone have any ideas?

 

Thanks

Maximus.

[Michael]

By default the Default Domain Policy will affect everything, unless you enable block inheritance.

 

I would make sure the computer and user objects are under the relevant OU you wish to apply policies to.

[Maximus]

The User is in the School OU and the computers are all in OU's under the School OU.

 

Regards

Maximus

[Gatt]

@Maximus - have you ran GPResult in GPMC to see where its failing?

is it possible to post how your GPO is configured?

[Michael]

So it sounds like pupils are in the root of the School OU, with computers in sub OUs which is absolutely fine.

 

Instead of linking the policy, try applying it directly to the School OU.

[imiddleton25]

have you tried running gpupdate /force on workstation to see if it works

we have had a problem last 2 days in group policy not updating very quickly

Havent got to the bottom of it yet

[Gatt]

i dont think you can apply it directly to the OU - the linking is prety much the same thing - you create your GPO, which appears in the Group Policy Object tree in GPMC, you then drag it to your OU, or right click the OU and select "Link Existing GPO" and select it.

[Gatt]

Are there any other GPO's active with the same settings?

 

Try selected the "Enforced" Flag on the GPO - this way, it makes sure that GPO "wins" and isnt overruled by another GPO

 

Running GPResult will tell you which GPO "wins" - note that any "Disabled" settings will overrule a similar set Enabled/Not Configured setting - similar to the Deny rule with NTFS

 

@imiddleton25 - check your GPO refresh settings (Default Domain Policy is best so it applies to all) should be under Comptuer Config -> Admin Templates -> System -> Group Policy -> Group Policy Refresh Rate for Comptuers

The default refresh is every 90 minutes

 

Also read somewhere about XP sometimes takes about 3 reboots for some GPOs to kick in!!

Edited June 4, 2008 by Gatt

[FN-GM]

Is it just one setting or all of the group policy?

 

Z

[Maximus]

At the moment I only have the one GPO other than the default ones (its a network rebuild).

 

None of the settings have applied.

 

I did use gpupdate but to be honest i don't think i used the /forceupdate switch although the cmd prompt did say something about the policies being applied.

 

I know microsoft say not to change the default domain policy (i have already so we can have only 6 characters for a password, we're talking primary school kids here ), but has anyone done this as it seems the easiest way to get settings to stick? If so did you have any problems?

 

The other reason i was thinking about using the default domain policy is that it seems that if you have more than a very few policies, they all seem to fight each other as to which setting get applied. Is this my imagination or have other people found this aswell.

 

A large part (if not nearly all) of our network is wireless, how have people found policy setting being applied across a wireless network.

 

Thanks for the info guys

 

Maximus.

[Michael]

i dont think you can apply it directly to the OU - the linking is prety much the same thing - you create your GPO, which appears in the Group Policy Object tree in GPMC, you then drag it to your OU, or right click the OU and select "Link Existing GPO" and select it.

 

You can apply policies directly. Generally speaking I'd only use linking within very large domains with many OUs. Most of the sites I support have just four or five OUs so it isn't much work. When you edit the Default Domain Policy, you're not linking from anywhere, but applying directly.

 

I know microsoft say not to change the default domain policy (i have already so we can have only 6 characters for a password, we're talking primary school kids here ), but has anyone done this as it seems the easiest way to get settings to stick? If so did you have any problems?

 

For the most part Microsoft are right, but for example you may want to apply proxy settings at default domain level as everyone will require it, or the default homepage which applies to everyone. Remember though, this would also apply to Domain Controllers so choose what you edit with caution.

You example of the password is a good one also, but to get around the problem (at primary level) the children's password I set is usually password which they can remember.

 

In Windows Server 2003, you can only change password requirements at domain level. You'd have to create a sub domain to create different requirements for other users. Windows Server 2008 allows you to change password requirements per OU I believe.

 

The other reason i was thinking about using the default domain policy is that it seems that if you have more than a very few policies, they all seem to fight each other as to which setting get applied. Is this my imagination or have other people found this aswell.

 

Not quite sure what you mean. Lets say I set the homepage as BBC - Homepage on the default domain policy, but set EduGeek.net on the School OU, then the policy on the School OU would win.

If I disabled proxy settings on the default domain policy, but enabled them within School OU, School OU would win. However if I changed nothing in School OU, it would inherit from the Default Domain Policy.

 

Wireless makes no difference in my experience when it comes to Group Policies as they are tiny. No more than a few megabytes. It's file transfers which are most noticeable, such as roaming profiles or copying data.

Edited June 4, 2008 by Michael