Group Policy - Settings report shows Not Configured Items

[Arcolite]

I've searched for the answer for this for ages and it's driving me made.

This happens with all GPO's but for example I'll use a clean GPO.

 

If I create a new GPO in the GPMC on Server 2008 R2 and then configure something in the ADMX side it works as expected. The Settings report shows the correct setting.

If then undo that setting and revert it back to Not Configured I expect the Settings report to so that the GPO is empty. However, this isn't the case. It still shows me the Setting and also that it's set as Not Configured.

 

It's not actually applying anything, the Not Configured is working. It's more a visual quirk, but a irritating one!

 

I know there was a KB update to fix the Backspace issue. Has there been anything relating to this? Has anyone else had this problem.

[RageRiot]

that is what is supose to happen.

 

 

if I understood you correctly the settings tab shows you the configured settings regardless of if the gpo is eneable or not. it allows to to get an overview of what should be applying so you dont have to trail through the editor.

Edited March 22, 2012 by RageRiot

[chazzy2501]

I am right in thinking that if I enable a gpo setting, then later changing that setting it as not configured that the client will leave that GPO setting as on? Then having the gpo show not configured would be helpful.

[RageRiot]

having an individual setting in a gpo set to not configured is the same as not having the GPO or having the GPO disabled.

 

it means it will ignore the GPO and set that setting based upon the local Group policy on the target client.

[Arcolite]

Is this new behaviour in 2008/R2? In 2003 R2 once I set something back to Not Configured it no longer appears in the Settings report (because there isn't anything set anymore).

The Settings report used to only show you Enabled or Disabled items.

 

It's a little messy because we do all our development in test OU's, not on live clients. So if we enable something to "try it out" then decide we don't want to use it, that GPO will be left with the traces of that test.

We'd have to recreate the GPO again when we want to put that GPO into production.

Edited March 23, 2012 by Arcolite

[RageRiot]

hmm. I'm a little suprised that people use the settings tabs as an indication if it's on or off. I see it completly different, from my perspective it should show settings regardless of if the link is enabled or disable or the computer or user settings are enabled or disabled. this as far as i know is the expected behavior since you can visually see if a GPO link is enabled and/or if a scope is or isnt on the details tab.

[Arcolite]

I don't mean GPO Link status, I mean the actual settings status contained within the GPO.

 

For example. If I go into a GPO and set "Verbose vs normal status messages" to Enabled. The Settings report shows Enabled.

Later down the road I decide I no longer want that. I set it back to Not Configured in the GPO. Previously this would remove the entry for this Setting from the Settings report, however now it shows it as Not Configured.

 

That means I have a entry in a report telling me that something isn't configured...which isn't very helpful.

 

Edited March 23, 2012 by Arcolite

[RageRiot]

it is helpful. the client will assume default settings or follow its local GP settings .

[Arcolite]

it is helpful. the client will assume default settings or follow its local GP settings .

 

In which case, I don't need to know that something is not configured.

Otherwise they might as well show me the entire contents of the GPO regardless of their configuration status.

Edited March 23, 2012 by Arcolite

[RageRiot]

after a secoond look at the picture i realise what you mean but it still makes sense. Maybe GPs have atributes that are aet when any setting is altered. So changing it from enable or disable and then to not configured will force it to still ahow in the settings tab

[PiqueABoo]

Maybe GPs have atributes that are aet when any setting is altered.

 

The overwhelming majority do NOT, they either exist in a registry.pol file with a value e.g. [enabled|disabled, 27, "Hello World!"] or they don't. The screenshot shows folder redirection which is handled by a GP extension - settings for folder redirection live in a fdeploy.ini file within the GPOs sysvol folder. If it's top of anyone's priority list than then a) Can I have your job? b) Go find that file and edit the setting out with notepad (if you have multiple DCs then I would go toggle a normal setting in that GPO so the version number changes).

[RageRiot]

The overwhelming majority do NOT, they either exist in a registry.pol file with a value e.g. [enabled|disabled, 27, "Hello World!"] or they don't. The screenshot shows folder redirection which is handled by a GP extension - settings for folder redirection live in a fdeploy.ini file within the GPOs sysvol folder. If it's top of anyone's priority list than then a) Can I have your job? b) Go find that file and edit the setting out with notepad (if you have multiple DCs then I would go toggle a normal setting in that GPO so the version number changes).

 

well obviously in the OPs case somthing is stored.

I asume your askin for his job? otherwise no

[PiqueABoo]

well obviously in the OPs case somthing is stored.

 

Yes, you just quoted my not-Googled explanation of where those specific settings are stored and how the OP might fix their (non-systematic) problem.

 

I asume your askin for his job?

 

Not really, just a job where once in a while I might have time to care about this kind of issue.

[Arcolite]

The overwhelming majority do NOT, they either exist in a registry.pol file with a value e.g. [enabled|disabled, 27, "Hello World!"] or they don't. The screenshot shows folder redirection which is handled by a GP extension - settings for folder redirection live in a fdeploy.ini file within the GPOs sysvol folder. If it's top of anyone's priority list than then a) Can I have your job? b) Go find that file and edit the setting out with notepad (if you have multiple DCs then I would go toggle a normal setting in that GPO so the version number changes).

 

If it's as simple as that, awesome.

 

I wouldn't say this is top priority, but we're in the process of creating our brand new Windows 7 GPO's and OU Structure. but I'm very protective and slightly OCD about my GPO's. I want them perfect and stuff like this bugs me.

If someone else in the department looks at the Settings report I want to be able to give them a informed answer on why that still shows up rather than a "meh! dunno".

 

Surely this is a bug in GPMC?

Edited March 23, 2012 by Arcolite

[PiqueABoo]

If it's as simple as that, awesome.

 

It should be, but I'm not saying it's perfectly safe so do take a copy of the original before you fiddle, in fact just back up your GPOs via GPMC like conscientious admins are supposed to every so often. Then rather than using notepad and wondering which bit to edit it's probably easier to make a new throwaway GPO, configure the folder redirection there without touching any folder you don't want redirected, and try copying the fdeploy.ini from the new GPO over the fdeploy.ini in the original GPO. If it all works OK throwaway the new GPO.

 

Surely this is a bug in GPMC?

 

Doubtful - it could easily be an unavoidable side-effect of folder redirection e.g. in some scenarios it *might* need to know the difference between "was never configured" and "was configured but isn't now".

[Arcolite]

Just to provide an update to this. I've been testing and can confirm that this only happens with Folder Redirection settings. When all other settings are put back to Not Configured they are removed from the Settings report as expected.

[andrewjms]

This thread is a bit stale but in case you wanted to know...

 

I make no claims that this won't break something else when you edit it, but I think what you are looking for is the gPCUserExtensionNames attribute of the policy under CN={GUID of the policy},CN=Policies,CN=SYSTEM,DC=DOMAIN,DC=COM. You can edit this with ADSIEDIT.msc, etc.

 

It looks as if GroupPolicyEntenstions like Folder Redirection, which don't store their settings directly in registry.pol, appear to add to a list GUIDs in this attribute which is how the GPMC knows to look for the settings elsewhere. Modifying that attribute to remove the GUID for the specific part of Folder Redirection you were using, or completely removing the attribute will clear the phantom settings in GPMC. Removing the entire thing would of course remove any other gPEs too, so be careful.

 

It's trivial but I too found this annoying when looking at a policies and attempting to see what settings are actually set, as opposed to previously set. Nearly as annoying the as bug which MS is not patching in 2008R2 where a comment once set, cannot be blanked in the GUI (you can reduce the comment to a singe space of course). They can be removed by editing the comment.cmtx however. That has the same effect of possibly showing un-configured settings.

[PiqueABoo]

That rang very true so I just looked at one. I'm calling it a list of sets of GUIDs, each set is enclosed in square brackets and apparently dedicated to a specific area e.g. I found folder redirection:

 

 

[{25537BA6-77A8-11D2-9B6C-0000F8080861}{88E729D6-BDC1-11D1-BD2A-00C04FB9603F}]

 

Having searched, that's apparently the folder redirection "CSE GUID" and "Tool Extension GUID (User Policy Settings)" respectively. MS-GPFR.pdf

 

CSE GUID: A GUID that enables a specific client-side extension on the Group Policy Client to be associated with policy data that is stored in the logical and physical components of a Group Policy Object (GPO) on the Group Policy Server, for that particular extension.

 

Tool Extension GUID: A GUID defined separately for each of the user policy settings and computer policy settings that associates a specific administrative tool plug-in with a set of policy settings that can be stored in a Group Policy Object (GPO).

[tobbo166]

having an individual setting in a gpo set to not configured is the same as not having the GPO or having the GPO disabled.

 

it means it will ignore the GPO and set that setting based upon the local Group policy on the target client.

 

Hi! Trying to interpret this, if the setting earlier was set to enabled. Next we set it to not configured. Will the local Group Policy not be enabled then, as it was configured to be earlier? I.e. GPO, centrally is configuring a local GPO to be enabled. Later we set that GPO to not configured. Would the client not remember the last setting, hence leaving it enabled, but (!) configurable?

 

Now to my next question: if we build machines and want to have a setting enabled, in this case cached mode in Outlook always on. But, we want this to be configurable by the user. Though, enabled should be default, unless they change it. How is this accomplished via GPO? We want only users who are local admins to be able to change this setting, please.

[Simplexion]

I have just found this actually causes issues when Enforcing a GPO. We recently enforced our Default Domain Policy so it applies to OUs with Blocked Inheritance. In enforcing this it caused our Start Menu to no longer redirect. I found that in the Default Domain Policy, Start Menu Redirection was set to Not Configured. This caused it to apply as not configured and ignore a policy applied further down.

[Simplexion]

To remove the left over Not Configured Folder Redirection policy you need to do as follows:

 

• Remove the Documents and Settings folder under \\domain\sysvol\Policies\{GPO GUID}\User (This will remove the fdeploy.ini files as well)
  
• Open AD Users and Computers. Turn on Advanced Features (View->Advanced Features). Navigate to System->Policies->{GPO GUID}. Right click on {GPO GUID}, choose Properties. In the dialog that pops up, switch to Attribute Editor. Scroll down to gPCUserExtensionNames, and double click it.
  
• This will pop up a dialog with a long text entry box, and a bunch of GUIDs. This attribute defines the list of GP Extensions associated with this GPO in the User context. Immediately above it you'll see the related attribute gPCMachineExtensionNames which defines the associated GP extensions in the Machine context of the GPO.
  
• Delete the following entry from gPCUserExtensionNames : [{25537BA6-77A8-11D2-9B6C-0000F8080861}{88E729D6-BDC1-11D1-BD2A-00C04FB9603F}] (including the square brackets)
  
• Click OK, and you're done.
  

 

* These instructions are taken from: windows server 2008 - How can I erase the traces of Folder Redirection from the Default Domain Policy - Server Fault