New users not getting GP assigned Start Menu

[Blackadder]

It's a bit of a weird one really.

 

I have six identical ICT suites all of which untill recently shared a common Start menu located on share from a 2K3 R2 server... It worked perfectly for many years.

 

Then (for reasons beyond my control) I had to setup seperate menus for each room, again same method of applying and sharing the menus and this worked too...

 

Simples!

 

Or so I thought. Exisiting student users can see the menus but new students can't, I've checked the obvious like share permissions, they're members of the correct security groups etc.

 

Any ideas what could make this happen?

 

Cheers.

[chazzy2501]

OK just to help me out, your using a user level GPO to remap the desktop and start menus to a folder share on a 2k3 server. how are you then targeting those users in the different (I assume) computer OUs?

[Blackadder]

Correctamundo, for each room there's an OU containing the relevant computers, each OU has its own GPO to remap the Start menu.

 

Thanks

[chazzy2501]

sure but unless the users are in the same OU as the computers it won't apply.

 

I'm certain you cant apply a user gpo to an OU that contains only your computers and expect it to apply the user portion (of the GPO) to users who log onto them.

 

Unless both your users and computers are in that OU the policy won't have the desired affect.

[Blackadder]

I've had the same setup for about 6 (ish... my mind is going!) years and it's worked faultlessly, obviously adding new many new users along the way.

 

Here's a very cut down version of how looked before the changes, please excuse the crap diagram:

 

curriculum.school.local

|

| --> Curriculum

| *Startmenu_remap_GPO_here*

| |

| | --> Students

| | |

| | | --> 2005

| | | --> 2006

| | | --> 2007

| |

| | --> Worksations

| | |

| | | --> Room1

| | | --> Room2

| | | --> Room3

 

 

 

 

 

Here's the new setup, which has worked for around 3 months now:

 

 

 

 

curriculum.school.local

|

| --> Curriculum

| |

| | --> Students

| | |

| | | --> 2005

| | | --> 2006

| | | --> 2007

| |

| | --> Worksations

| | |

| | | --> Room1

| | | Startmenu_remap_for_room1

| | |

| | | --> Room2

| | | Startmenu_remap_for_room2

| | |

| | | --> Room3

| | | Startmenu_remap_for_room3

 

 

Hope that clarifies the layout.

 

 

Thanks

[box_l]

as stated by chazzy2501, you seem to be applying user gp to a computer ou.

 

previously your gp was being inherited down to the users ou, now the users are above and cannot see it.

 

BoX

[Domino]

applying a user policy to a computer OU is perfectly acceptable - you just need to enable loopback processing

 

Loopback processing of Group Policy

 

I don't suppose the new users are missing this?

[Blackadder]

@box_l

 

I understand what was said previously, but it doesn't explain why existing users have no issues seeing the new Start menus and why new users can't.

 

But thanks for the input.

 

 

@domino

 

Thanks, going to give it a shot now.

Edited March 2, 2010 by Blackadder

[chazzy2501]

Heh! I never knew that was possible. This should allow for some nice tweaks to my own gpo now.

[box_l]

@domino

 

agreed, but it did'nt look like that was happening before.

 

BoX

[Blackadder]

Hmmm... The plot thickens!

 

Tried Domino's solution but sadly to avail.

 

Looks like there may be some kind of security issue because during logoff a message flashes up about insufficient rights to access their roaming profile which I never spotted before, but, again the new users are all members of the same security groups as the existing users.

 

Anyway I gave a user full control permission (including sub files/folders) over their roaming profile, but still the access denied error appears (profile path is correct). Yet they can still access folders that are only available to certain security groups on network shares.

[Domino]

Have they got security rights over the GPO? and does the domain machines group too?

[Blackadder]

Thanks for the swift reply, checked the GPO rights and all authenticated have users access and by default machines aren't specified in the permissions list.

[Blackadder]

Looks like the problem is much more deep rooted then GP I'll start a new thread as my grey hairs are going white with stress.

 

Thank you everyone for your help.