Gongalong Posted June 25, 2012 Posted June 25, 2012 Hi folks, I'm struggling to understand what's happening with a group policy... I'm applying a GP to change the way Internet Explorer connects. I've made a couple of modifications to the policy, and am now testing to see if it has applied. On the test PC, IE's LAN settings were previously set manually. After logging in, and even after forcing a GPUPDATE, the modifications to the policy have not applied. If I use RSOP.MSC it shows the settings as per the policy (!). Anyone know if this is something peculiar to LAN settings e.g. if set manually they cannot be altered by a policy? TIA
synaesthesia Posted June 25, 2012 Posted June 25, 2012 What do you get in gpresult /r ? (run it in an elevated command prompt to ensure the right result) 1
chazzy2501 Posted June 25, 2012 Posted June 25, 2012 is your test PC in a valid OU? not just a container. This stopped some proxy settings working despite that GP settings being for users. 1
ricki Posted June 26, 2012 Posted June 26, 2012 Have you got the correct adm for the version of ie? Richard 1
Davit2005 Posted June 26, 2012 Posted June 26, 2012 Try and run gpresult /h [path to file] from a command prompt for a computer/user that should get the policy setting i.e. gpresult /h c:\gpresults\test.html Double click on the file once it has completed and browse down to the Internet it should show you the winning GPO policy for the settings and what the settings are for Internet Explorer maintenance. 1
Gongalong Posted June 26, 2012 Author Posted June 26, 2012 synaesthesia/Davit2005: GPRESULT shows the same thing as RSOP.MSC, that is the policy settings are there, but not actually applied to Internet Explorer. My guess is that altering the settings manually on the PC then causes the system to stay with those, despite what the policy is set to. Annoying, but it seems to be consistent at least. chazzy2501: the policy's being applied to user (IE settings only seem to be under the user section), but in any event the users are in a shared folder, not an OU (a historic issue, which I'm debating whether to change). The policy itself is set to apply to all authenticated users, and as per the above it is actually appearing on the PC. ricki: ADM?... Administrative Templates?
zlorimer Posted June 26, 2012 Posted June 26, 2012 cmd > gpresult /V > C:\gpresult.txt Post the results 1
bart21 Posted June 27, 2012 Posted June 27, 2012 are u applying the settings as a user or computer policy? if a user policy on a computer ou you will need loopback enabled. nick 1
Gongalong Posted June 27, 2012 Author Posted June 27, 2012 bart21: it's a user policy, because you can only set these particular IE settings via that as far as I can see. I'm not familiar with loopback, but as per below some of the settings are definitely being applied. zlorimer: unless I'm missing something the results via HTML and TXT file seem to conflict. Here's a screen capture of what the HTML version says is happening for IE connections. Image - TinyPic - Free Image Hosting, Photo Sharing & Video Hosting Here's what seems to be the relevant portion of the TXT file, where all the policies seem to be denied. This can't be the case though as part of the user settings are some scripts that map drives, and those drives are being mapped. That's aside from some UI changes that are also definitely being effected: USER SETTINGS -------------- CN=Administrator,CN=Users,DC=admin,DC=school,DC=local Last time Group Policy was applied: 25/06/2012 at 13:00:58 Group Policy was applied from: VA-DC1.admin.school.local Group Policy slow link threshold: 500 kbps Domain Name: ADMIN Domain Type: Windows 2000 Applied Group Policy Objects ----------------------------- Default Domain Policy The following GPOs were not applied because they were filtered out ------------------------------------------------------------------- Admin PCs Deploy Filtering: Denied (Security) Admin PCs Filtering: Denied (Security) ITS PCs Deploy Test Filtering: Denied (Security) WSUS Policy Admin PCs Filtering: Denied (Security) Admin Users Filtering: Denied (Security) NetOps Filtering: Denied (Security) WSUS Policy ITS PCs Filtering: Denied (Security) Teaching Staff Filtering: Denied (Security) Local Group Policy Filtering: Not Applied (Empty) The user is a part of the following security groups --------------------------------------------------- Domain Users Everyone BUILTIN\Users BUILTIN\Administrators NT AUTHORITY\INTERACTIVE CONSOLE LOGON NT AUTHORITY\Authenticated Users This Organization LOCAL Domain Admins Group Policy Creator Owners SophosUser SophosAdministrator Denied RODC Password Replication Group SophosPowerUser High Mandatory Level The user has the following security privileges ---------------------------------------------- Bypass traverse checking Shut down the system Remove computer from docking station Increase a process working set Change the time zone Manage auditing and security log Back up files and directories Restore files and directories Change the system time Force shutdown from a remote system Take ownership of files or other objects Debug programs Modify firmware environment values Profile system performance Profile single process Increase scheduling priority Load and unload device drivers Create a pagefile Adjust memory quotas for a process Perform volume maintenance tasks Impersonate a client after authentication Create global objects Create symbolic links Resultant Set Of Policies for User ----------------------------------- Software Installations ---------------------- N/A Logon Scripts ------------- N/A Logoff Scripts -------------- N/A Public Key Policies ------------------- N/A Administrative Templates ------------------------ N/A Folder Redirection ------------------ N/A Internet Explorer Browser User Interface ---------------------------------------- N/A Internet Explorer Connection ---------------------------- N/A Internet Explorer URLs ---------------------- N/A Internet Explorer Security -------------------------- N/A Internet Explorer Programs -------------------------- N/A
bart21 Posted June 27, 2012 Posted June 27, 2012 look here re loopback Loopback processing of Group Policy have you checked read permissions on the gpo? nick 1
chazzy2501 Posted June 27, 2012 Posted June 27, 2012 chazzy2501: the policy's being applied to user (IE settings only seem to be under the user section), but in any event the users are in a shared folder, not an OU (a historic issue, which I'm debating whether to change). The policy itself is set to apply to all authenticated users, and as per the above it is actually appearing on the PC. Yes this is what was happening to me, the USER settings for IE were not being applied because my COMPUTER was not in a valid OU but a container. This only seemed to affect IEs settings (Proxy, URLs, ECT) 1
Gongalong Posted June 27, 2012 Author Posted June 27, 2012 bart21: Thanks. "Authenticated Users" have read permissions. chazzy2501: I might go the OU route if this becomes desperate!
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now