Cannot get group policy to apply

[flexyjerkov]

I am trying to get a user configuration policy to restrict pupils from accessing the run button.

 

I have set it all up using the administrative templates and made sure that the user is in the same organizational unit as the policy but when i log on as a user within the organizational unit it does not seem to apply the policy. Any ideas if I'm doing something wrong here as i got no idea...

 

Thanks

[Geoff]

Run the GPMC Modelling and Results wizards. This should tell you exactly whats happening and if there's a problem.

[flexyjerkov]

Just looked on here geoff: http://technet2.microsoft.com/WindowsServer/en/library/4100c1ff-2644-431f-a61d-dd7b569c836a1033.mspx?mfr=true

from what i can see you need at least server 2003.

 

We're currently running on server 2000

 

Any ideas?

 

http://flexy.tnradio.net/dump.gif

 

Does this help at all?

[Geoff]

GPMC Modelling requires Windows 2003. The other functionalitiy will work correctly with Windows 2000 DCs though.

[flexyjerkov]

Ok still no good. I've uploaded the results. Could you have a look to see if I've done anything stupid...

 

http://flexy.tnradio.net/help.htm

[Geoff]

I see nothing wrong with that. However it also depends on how this GPO is interacting with the others that apply to this machine/user combination. Run the Group Policy results wizard to figure this out.

[djm968]

The policy looks fine, have you tried a GPUPDATE on the client?

 

Also try runing rsop.msc and gpresult on the client and check the event viewer.

[flexyjerkov]

Results Wizard:

 

http://flexy.tnradio.net/reportuser.htm

 

I don't see anything wrong from the results wizard but still not working...

[djm968]

From the results it looks like the GPO is not being processed at all, did you try a GPUPDATE on the client?

[ajbritton]

Another very useful tool is Policy Reporter

[flexyjerkov]

yes i done a gpupdate and a gpupdate /force but makes no difference. The user is in the right organizational unit too.

[djm968]

Do you have more than one DC on the domain? If so check the other DC and see if the GPO has been replicated. The client could be obtaining group policy from the other DC.

[flexyjerkov]

We have 3 DC's in the school but all 3 of them seem to be replicating fine.

[Andie]

OK, I'm a newbie and this is probably just stupid, but....

 

Have you linked the policy to the OU? I spent a long time with a much more experienced person puzzling over the same kind of problem, and it eventually dawned on him that we just hadn't linked the policy to the OU so it wasn't being applied.

 

OK, I'll go back in the box now....

[Geoff]

Also check the client PC for errors in it's event log. It also might be helpful to enable user environment debugging to assist in this.

 

http://support.microsoft.com/kb/221833

[pooley]

DNS ??

[Kained]

Just try and disable windows firewall for me then do a force update reboot the pc and see if that works

[flexyjerkov]

Ok... I can apply user configuration settings in the "default domain policy" which sits above everything else but everything below that seems to be ignored?

 

Does this help...

[Geoff]

Are you blocking inheritance on the OU or a parent OU above the OU where the GPO is linked in?