GPO Inheritance

[Tricky_Dicky]

Hi,

 

Within Active Directory I have several Organizational units each with their own GPOs. Basically if the top level has a policy set(e.g. security) should that be then inherited to all child objects unless it is over ridden. So as long as I don't configure it differently it will use it.

 

Also, is there anyway to check how big the GPO is? I don't know if that's a stupid question, but our laptops seem to take ages to log on and I'm trying to figure out why.

 

Regards

 

Richard

[big_nath]

Hi richard,

 

Here is a good link regarding gpo's, specifically inheritance. Group Policy Inheritance.

 

You can use group policy results wizard to see what GPO's are being applied. here is a link that will help you with that Using Group Policy Modeling and Group Policy Results to Evaluate Group Policy Settings

[powdarrmonkey]

Within Active Directory I have several Organizational units each with their own GPOs. Basically if the top level has a policy set(e.g. security) should that be then inherited to all child objects unless it is over ridden. So as long as I don't configure it differently it will use it.

 

Yes. Was it meant to be a question?

 

Also, is there anyway to check how big the GPO is? I don't know if that's a stupid question, but our laptops seem to take ages to log on and I'm trying to figure out why.

 

The actual files are in \\\sysvol\\Policies, one GUID folder per policy object.

[m25man]

Could you not create a test OU outside of your normal tree/branch/leaf move one of the offending LT's into this do a gpupdate /force /sync /boot and see what happens?

 

Im guessing your LT's are wireless and there is probably a whole lot more going on at login time than just your GPO's being applied!

 

Find out which server your GPO is being copied from.

Go to the server,

Ping the offending client by both name and IP address.

 

If you have a problem with either name or ip pings your issue could be DNS related.

 

GPO's regularly fail when a client has more than one rDNS entry.

[Tricky_Dicky]

Yes, it was meant to be a question, sorry.

 

Cheers for the links, very useful.

 

Rich

[Tricky_Dicky]

m25man,

 

It's a very simple network. I have 1 server at the moment which is doing everything.

 

I suspect it is just a rubbish wireless network which is causing things to mess up but I have an evaluation of the Ruckus kit coming in on Monday . I've already waved the quote under the powers that be and they seem keen.

 

Are there any other things that you could think of that could be slowing down logons? I'm using Mandatory profiles if that makes a difference?

 

Rich

[big_nath]

m25man,

 

It's a very simple network. I have 1 server at the moment which is doing everything.

 

I suspect it is just a rubbish wireless network which is causing things to mess up but I have an evaluation of the Ruckus kit coming in on Monday . I've already waved the quote under the powers that be and they seem keen.

 

Are there any other things that you could think of that could be slowing down logons? I'm using Mandatory profiles if that makes a difference?

 

Rich

 

How big are the profiles? and how long is it taking to log on?

[Tricky_Dicky]

Student Profile is 1,243KB.

If it works, can take 10 minutes, but often they don't log on properly so you get things like H drive not mapped or icons missing etc.

 

I have just changed some of the GPOs, like wait for network before loading -enable, which I'm hoping will mean that things are missed.

 

Rich

[powdarrmonkey]

I'd blame your wireless network.

[big_nath]

Student Profile is 1,243KB.

If it works, can take 10 minutes, but often they don't log on properly so you get things like H drive not mapped or icons missing etc.

 

I have just changed some of the GPOs, like wait for network before loading -enable, which I'm hoping will mean that things are missed.

 

Rich

 

the profile is not to big. It could be a logon script is hanging. The default time out is 10 minutes for that i beleive. Other than slow log on is the network quite responsive?

[Tricky_Dicky]

No, the network sucks.

Have a call open with Link2ICT at the moment as they installed it. It is an all Cisco network which doesn't seem to be able to handle large file transfers?!?

I was moving about 5GB from the server to a network drive last night and all the desktop icons dropped off the machines.

Any pointers for setting up the Ruckus, or is it straight forward enough?

Rich

[bob_uk2k]

Hi Rich,

 

Robert from Net-Ctrl here.

 

The Ruckus is very easy to setup.

 

The Zone Director (ZD) which is the brains behind it all needs a static IP so you know where to find it with your web browser then all the access points should be left to get an IP from DHCP, they will find their own way back to the ZD. The ZD will give the access points the config you setup in the ZD and the firmware they need also.

 

In the ZD you can setup one SSID or more which can let people on the network directly or challenge them with various methods to find out who they are all of which is fairly stright forward to do.

 

Most people are very happy to see how good the start up wizard is on the ZD and once that's done the rest sorts it's self.

 

Robert

[m25man]

No, the network sucks.

I was moving about 5GB from the server to a network drive last night and all the desktop icons dropped off the machines.

Rich

 

I guess that rules the wifi out then!

 

What server?

Which Raid Controller?

How many disks in the array?

What transfer speed are you getting over the wire on a 5Gb file transfer?

[Michael]

Basically if the top level has a policy set(e.g. security) should that be then inherited to all child objects unless it is over ridden.

 

If you set something on the Default Domain Policy (generally speaking you shouldn't), but for example I do set proxy settings on the default GPO, as of course all users/machines need it to connect to the internet.

 

As for everything else, if you have an OU and GPO called "Curriculum" anything under this will inherit your settings. Other OUs/GPOs such as Staff and MIS would not be affected as they are not within/under the Curriculum branch as it were

 

As for your slow logons, it does appear to be wireless related. Link2ICT are very much pro Cisco due to its manageability, but to be honest I too have noticed wired file transfers are much slower than say in another fully HP network which I manage. I'm only speculating but my theory is that the security settings set are too strict and that it may be interpreting the large file transfer as a broadcast storm. I have also wondered whether this has contributed to BGFL's recent internet problems. All their switches and school gateways are Cisco. I don't think it's a co-incidence to be honest...

 

What's logon like with your wired workstations? With a profile that size (similar to what I use) you're looking at a 30-60 second logon time in total. If you disable the wireless on the same laptop and connect an ethernet cable, is it any better? Have you tried rebooting all switches and access points?

[srochford]

Your comments about slow network transfers for the 5Gb file probably do rule out wireless but a really quick way to find out more would be to just plug a laptop into a wired socket and log on - is it any quicker? Assuming you've got 802.11g wireless and 100Mbit networking then if the wireless is the problem then you'd expect to see a substantial speed increase. If you don't then you can probably say that it's not the wireless at fault.

 

You can quickly see if the GPOs are causing a problem by creating a test OU and putting one machine in it. In the properties of the OU, block GP inheritance - in that way, no policies will apply and you get to see if they are having an adverse affect.

 

If you find that the test OU now goes more quickly then there may be too much going on in the GPO settings. This can be complicated to fix. Some policies will be slow the first time they apply but then will take almost no time (for example, if you set a policy to change the permissions on the whole of program files then this could take minutes to apply but should only apply once)

 

Google "userenv debug logging" to find out how to setup logging of the gpo application process. Basically, you end up with a log file showing you how long was spent at each stage of logon (remember to turn off the logging when you've finished - it adds to the logon burden!)

 

Good luck!

[Michael]

I would also recommend (if you haven't got it installed) is to install GPMC SP1 on Windows Server 2003. A very useful and easy to use tool to see just what policies are applied at computer and user levels.