Not applying user GPO first logon

[Bezwick]

Hi all got a really annyoing problem.

 

We have Server 2008 R2 domain, and are updating our clients to Windows 7 (finally). I have everything working fine except one thing.

 

All the students use a Mandatory profile \\server\netlogon\profile\mandatory.v2, it works fine.

The machines have a GPO for each classroom which sets up things like printers etc.

When the students logon they have a GPO the redirects menus, locks fetures etc as you would expect.

 

The prroblem i have is when you turn a mchine on and a student logs in it executes the Machine GPO and applies the Mandatory profile, but not the student GPO.

But if the student logs off and then straight back on again it works brilliantly.

 

Any ideas of how to get it all to work without logging on twice?

 

Cheers.

[wehr]

i experience the same but the other way around and with local GPO:

 

when the Profile is _new_ the LGPO will be applied.

 

For subsequent logins with existing profile c:\users\testuser the LGPO will not apply.

 

The only workaround i can see so far: prepare the ntuser.man with the GPO Settings already in Place.. not very flexible.

 

reagrds

MArkus

 

Hi all got a really annyoing problem.

 

We have Server 2008 R2 domain, and are updating our clients to Windows 7 (finally). I have everything working fine except one thing.

 

All the students use a Mandatory profile \\server\netlogon\profile\mandatory.v2, it works fine.

The machines have a GPO for each classroom which sets up things like printers etc.

When the students logon they have a GPO the redirects menus, locks fetures etc as you would expect.

 

The prroblem i have is when you turn a mchine on and a student logs in it executes the Machine GPO and applies the Mandatory profile, but not the student GPO.

But if the student logs off and then straight back on again it works brilliantly.

 

Any ideas of how to get it all to work without logging on twice?

 

Cheers.

[wehr]

I found the solution here at edugeek:

 

the ntuser.man got wrong permissions because i loaded it one time as writeable profile.

under hkcu

 

software\policies

software\microsoft\windows\currentversion\group policy

software\microsoft\windows\currentversion\policies

 

Add authenticated users with full access.

 

The group policy client seems to set permissons at this keys. for a logged mandatory user you will find read access again. the SID with read access in the ntuser.man is the user we used to customize the profile - so we need to put authenticated users back in.

 

Now this one of the reasons why Microsoft only supports the sysprep/copyprofile Method for creation of Mandatory Profiles.

 

best regards

 

Markus

[Michael]

Computer Config > Policies > Admin Templates > System > Logon - Always wait for the network at computer startup and logon - Enabled

[ricki]

Computer Config > Policies > Admin Templates > System > Logon - Always wait for the network at computer startup and logon - Enabled

 

HI Michael

 

I do this and it fixes a lot of things but not this one. I dont know why? My wallpaper will not update and my default ie home page will not update.

But on the secdon logon they work perfectly.

 

Richard

[Bezwick]

I already had this enabled, but it seams to have stopped doing it now anyway. Not sure what caused it or how it was fixed, but dont look a gift horse and all that.

 

Cheers everyone

 

Computer Config > Policies > Admin Templates > System > Logon - Always wait for the network at computer startup and logon - Enabled

[Michael]

Try reducing the GPO refresh down from the default 90 mins to less than 10 mins.

 

Computer Config > Admin Templates > System > Group Policy - Group Policy refresh interval for computers. Set to 5 and 9.

 

User Config > Admin Templates > System > Group Policy - Group Policy refresh interval for users. Set to 5 and 9.

 

This more suitable for school environments where pupils may only use ICT for 30-40 mins at a time.

[ricki]

Hi

 

Have a look at this Windows 7 Clients intermittently fail to apply group policy at startup

 

Then reboot

 

We had this when machine had 1 gig nic.

 

Richard