SuperHans Posted September 10, 2008 Posted September 10, 2008 I am really stuck with this. My predecessor kindly left no information about the group polices in place, and after re-imaging some machines with a new image I created I realised that the local polices were not set via GPOs. So I went in and edited the default domain GPO to allow domain\everyone and domain computers to load\unload drivers and silently succeed at unsigned drivers. This however did not work. I checked the permissions that these objects had which are read and apply. Logged on as a network administrator and ran gpupdate then gpresult and the results (which point to something not being right) are: N:\>gpresult Microsoft ® Windows ® XP Operating System Group Policy Result tool v2.0 Copyright © Microsoft Corp. 1981-2001 Created On 10/09/2008 at 12:37:31 COMPUTER SETTINGS ------------------ Applied Group Policy Objects ----------------------------- Default Domain Policy Stations Internet Proxy Configuration LOGON WARNING The following GPOs were not applied because they were filtered out ------------------------------------------------------------------- Local Group Policy Filtering: Not Applied (Empty) The computer is a part of the following security groups: -------------------------------------------------------- BUILTIN\Administrators Everyone SophosAdministrator SophosUser BUILTIN\Users NT AUTHORITY\NETWORK NT AUTHORITY\Authenticated Users IT-100$ Domain Computers USER SETTINGS -------------- Applied Group Policy Objects ----------------------------- Default Domain Policy Internet Proxy Configuration Supervisors Login Scripts The following GPOs were not applied because they were filtered out ------------------------------------------------------------------- Local Group Policy Filtering: Not Applied (Empty) The user is a part of the following security groups: ---------------------------------------------------- Domain Users Everyone SophosUser SophosAdministrator BUILTIN\Users BUILTIN\Administrators NT AUTHORITY\INTERACTIVE NT AUTHORITY\Authenticated Users LOCAL Staff Supervisors Ashcombe Internet Access Domain Admins Students Everybody The computer local security policy should be applying. It should work as the OU where the computers are not blocking inheritance of the default domain policy. The default domain policy is also enforced. Can anybody shed some light on this issue?!
penfold Posted September 10, 2008 Posted September 10, 2008 You shouldn't touch the default policy. It is too easy to mess it up. Instead create a new policy and apply that one to the OU where you computers are. You may want to check that you have them set so they wait for the network when booting so they will pull down all the changes from the GPO on first boot rather than after a few reboots.
SuperHans Posted September 12, 2008 Author Posted September 12, 2008 There is already one applied to our workstations OU, and split into rooms, they all inherite from that but the same issue is still happening. We do have two DCs and I wondered if it was a problrem with replication but it has been a few days now!
SuperHans Posted September 12, 2008 Author Posted September 12, 2008 I went and had another look, and the local security polices look like they are correct when I log in as an administrator, e.g. load/unload device drivers and the unsigned drivers to silently suceed, and everybody on the security settings. However when I log in as a student iI obvisouly can't check those settings are the same, although I can't see why they wouldn't be, but the problem still occurs...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now