Active Directory - Default domain policy is over-riding settings in OU policies

[jgcracknell]

Hi

 

Windows 2008R2 domain (2 servers)

 

I have 2 main user groups (Staff and Students)

 

Each has a different proxy server. However, whatever I set the proxy to in the default domain policy for IE it is the same for both staff and students. For my Firefox AD settings it does differ. I've gone all through the settings - tried to use "Enforced" - tried different methods - but the only way I could force a proxy change for one group is with a VBS script altering the registry.

 

If there Default Domain policy is set to nothing for IE then no proxy exists. I'd love to know what the problem is and how to solve it! Could it be a corrupted IE ADMX file???

[pritchardavid]

I had this problem the other day actually, but not with the default domain policy

 

I had two policys for the students (Was recreating one with all the windows 7 settings, no settings for xp, has we just got rid of the last xp computers, thank god, much easier to manage!)

 

When I was remaking the setting, I had both gpos open, once I decided a setting was not needed or was enabled on the new one, i took the old one and made it the deafault setting. Now when I done this for the proxy settings, everyone could not get on the internet because it was not applying, so the old one was still overtaking.

 

So have you got any other gpos for the staff and students?

That could be affecting it, like it did for me

 

 

Hope that helps

[jgcracknell]

Hi Dave

 

Yes, I've tried this. I've made new OUs with the only other policy being applied the default domain. I've gone into every policy, done some modelling. Everything.

 

Two things I've had mentioned. Someone said the PC settings might be over-riding the policy user settings or there is a loop-back setting somewhere in AD.

 

I've never been into AD in that great a depth before as it is usually nice and simple - but I think someone else might have been playing and ticked one of the many hidden boxes.

[jsnetman]

I also had this problem on Friday as we are changing proxies, theres a setting to make proxies the same for all machines somewhere in IE protion of GP. Once I disabled it users got their proxies by user GP.

[jgcracknell]

I also had this problem on Friday as we are changing proxies, theres a setting to make proxies the same for all machines somewhere in IE protion of GP. Once I disabled it users got their proxies by user GP.

 

Do you know where this is hidden?

[jsnetman]

Computer Configuration->Adminsitrative Templates->Windows Components->Internet Explorer

 

I would check all machine policies which your machines may be in.

[pritchardavid]

umm best maybe

 

install gpmc (unless you got it already)

 

That way you can click on each gpo and it will tell you all the settings appiled on that gpo, that way you may find something in one of them

[jgcracknell]

Doesn't gpmc come with Windows 2008R2?

[jsnetman]

I remember way back when I setup my 2003 domain, I set up the GP to use proxy settings by machine and imported the setting from my admin machine. I must admit proxy settings are a nightmare with group policy, it might pay you to actually deliver them via a regedit script. But as I say when I hunted down the set proxy by machine and disabled it, user got the proxy by specifying it in the user portion of group policy.

[pritchardavid]

yer it does come with 2008r2, sorry forgot you said that is your first post

[jgcracknell]

Hi

 

Whoever set this up on some policies for Printers and settings I have

 

Computer Configuration (Enabled)hide

Policieshide

Administrative Templateshide

Policy definitions (ADMX files) retrieved from the local machine.System/Group Policyhide

Policy Setting Comment

User Group Policy loopback processing mode Enabled

Mode: Merge

 

and some are Mode: Loopback

 

Would that have anything to do with the problems?

 

J.

[pritchardavid]

has long has it hasent got the proxy settings changed in it, it shouldnt be the problem

 

 

how extually is the users gpos setup

 

One for staff?

One for students?

 

Do you a remote system to get into your servers? If so and if your allowed, make me a temp user account that can edit gpos and i'll have a proper look at what you got, im pretty good at working with gpo's