CC3 GPOs still coming across?

[cheesypete]

This post is linked to the one regarding the move from CC3 to a vanilla one, but i felt this warranted a separate thread as its a specific request for help!

 

To summarise from the start, we are looking to migrate from a CC3 network to a vanilla one but its going to be a gradual process, rather than my desired "lets pull the pug and start from scratch!"

 

Therefore, we have created a room of vanilla clients, and have created OUs / GPOs outside of the RM CC3 active directory structure. Have set the GPOs to use loopback processing with replace to stop RM GPOs from applying to the clients (as informed by Jose and Piqueaboo in aforementioned thread)

 

The thing is, we are still experiencing certain "non-vanilla" settings - for example Synchronise runs upon the user logging out..this is definitely disabled in the GPO

 

Interestingly if we create a completely new user using the standard Windows 2003 ADUC everything works fine...UNTIL...a user created using the RM management console logs on. This seems to "pull across" RM settings to the XP machine which then also apply to the "vanilla" user eg\synchronisation occurs, icons disappear

 

In effect the machine kind of becomes an RM client

 

Does this sound familiar to anyone? Any advice?

[jamesb]

Is CC3 setting machine policies in GPOs applied to the users, then enforcing them?

 

That's what it sounds like to me at least, particularly if your clean users work fine on the machines, then the RM ones pull down GPs.

[kmount]

I can confirm that we have RM Users using Vanilla machines with no problems through this kind of policy blocking etc.

 

I'm not sure why this is happening to you though=/

[Michael]

You could always block policy inheritance (on your new OU) until the whole of your network is moved over to a vanilla setup.

 

However, I suspect it may have something to do with the location of your user objects and computer objects, which is why (realistically) it would be easier to just start again. Alternatively you could setup a second domain, but of course you'd require another server.

[Jose]

what you have to remember is that your user accounts probably have to logon to both cc3 and vanilla so your probably better off trying to solve issues by using computer /machine policies otherwise you could get in a sticky mess.

 

Have a policy on the ou that contains the vanilla clients and do the following.

disable roaming profiles, force local profiles only.

force "wait for the network" option, this will ensure your new policies get through.

 

disable offline files options on vanilla machines by

computer configuration/administrative templates/network/offline files

disable several options in there.

[cheesypete]

Thanks for the replies everyone - have just sat down at my desk and seen the responses

 

Just to confirm the current settings

[*]Vanilla OU has inheritance blocked and doesnt apply the Default Domain Policy (not that that does much anyway)

[*]The GPO has been set to user loopback processing (replace) so that only computer policies are applied

 

Jose - appreciate the last response, thats something i havent looked at

 

The second domain aspect is something i have literally just discussed with my ICT techs.

 

Will have another crack at this tomorrow