Item Level Targetting

[Michael]

Hello all,

 

I'm having real difficulty getting Item Level Targetting to work properly. My opinion of it is diminishing quickly as it just does what it feels like!

 

Under the Curriculum OU, under Computer Config, I've created a new Scheduled Task as follows:

 

Name: Shutdown Workstations

Run: %SystemRoot%\System32\Shutdown.exe

Arguments: -f -s -t 120

 

On the Common tab, I've enabled Item Level Targetting and I've tried the following:

 

Organizational Unit, specified the Curriculum OU and ticked 'Direct member only'.

 

This shuts down all workstations, even if they're in a separate OU (not a sub OU). Any ideas why this is?

 

I then tried IP Address Range and specified 192.168.0.100 to 192.168.0.200

 

I have some workstations setup with static IPs outside of this scope 192.168.0.91, 92, 93 etc...

 

This also seems to shutdown all workstations, even if they're outside of the scope (as above). Any ideas why this is?

[mtdmitchell]

Use Item Level Targetting all the time in various ways - Ive never ticked the 'Direct member only' option though....try with out this option. Just selecting the OU has always worked for me.

[Michael]

I've tried it ticked and unticked, yet it still shuts down everything.

 

I can re-create this problem on three different networks. It looks like a bug to me...

[Admiral208]

if you apply the GPO to the just the curriculum OU, why are you using item level targeting? Which computers are you trying to shutdown? It wont apply to computers outside of the OU.

[Michael]

I've found a workaround, hope this helps someone else.

 

Imagine there are 4 seperate OUs (not sub OUs), all with their own separate GPOs.

 

OU 1, GPO 1

OU 2, GPO 2

OU 3, GPO 3

OU 4, GPO 4

 

Under OU 1, under Computer Config > Preferences, I've created a new Scheduled Task as follows:

 

Name: Shutdown Workstations

Run: %SystemRoot%\System32\Shutdown.exe

Arguments: -f -s -t 120

 

I then applied Item Level Targetting which clearly does not work in this case. For some weird reason, the Shutdown Workstations policy was appearing on workstations not in or linked to OU 1, GPO 1.

 

The workaround is quite simple. Copy the Shutdown Workstations policy to the other remaining GPOs - GPO2, GPO3 and GPO4.

 

Right click Shutdown Workstations and change the Action to 'Delete'. Just make sure the policy remains Enabled and not Disabled.

 

Now either restart the workstation or run gpupdate /force and like magic it works.

[Michael]

if you apply the GPO to the just the curriculum OU, why are you using item level targeting? Which computers are you trying to shutdown? It wont apply to computers outside of the OU.

 

This is precisely my point. IT IS applying to workstations outside the OU. I have reported this to Microsoft.

[Admiral208]

fine, but my question still stands. why are you using item level targeting in this case?

 

This should be used to narrow down the number of computers in an OU that the policy is applied to. If you apply the gpo to an OU normally, you wouldnt use item level targeting?

[Admiral208]

Also, can you run a gpresult on a computer outside of the ou to see if it is being applied?

[Michael]

fine, but my question still stands. why are you using item level targeting in this case?

 

Because the policy was applying to workstations outside of OU1.

 

Also, can you run a gpresult on a computer outside of the ou to see if it is being applied?

 

I have done this and gpresults come back normal. The policy I set isn't there/visible which is correct, yet the task is been applied. It's really odd.

[Admiral208]

OK, so the policy was applying to computers outside of the OU before you applied item level targeting to the GPO? You made it sound like the error was caused because you had item level targeting applied.

 

can you run a group policy result in the GPMC to see where the computer is getting the shutdown task from.

[Michael]

Apologies for not being clearer. Yes the problem was there, so I then explored Item Level Targetting.

 

I've ran the Group Policy result (just on computers outside the OU) and again, nothing comes up.

[Admiral208]

could you turn the policy into a batch file and run that as a scheduled task?

[Michael]

I could, but I have found a workaround in post 5. Essentially I've created a conflict of policy, so the setting per GPO takes precedence.

 

I have tested this running gpupdate /force and a normal restart and it does work properly. That's the main thing! Thank you for your suggestions though.