Sign in with
Sign up | Sign in
Your question

Domain GPO Not Applying

Last response: in Windows 2000/NT
Share
Anonymous
February 22, 2005 12:49:01 PM

Archived from groups: microsoft.public.win2000.group_policy (More info?)

I have a Domain level GPO, with User Config settings to execute a Logon
Script for users. About 1/3 of my users are actually getting the script. In
one instance I ran the GP Result tool from the GPMC to see if the policy was
even working, it shows that this particular policy is denied, based on a
security filter.

I left the policy setting to be the default Authenticated Users to Read and
Apply:

Does this mean that my user was not authenticated at the time of logon? And
that a Cached profile was used to logon?

I also made this change, but can not seem to find it again, nor can the
GPMC...little confused here, but basically when I was reading the
description...it had to do with why it takes 2 logons sometimes to process a
GPO...

Thanks

---------GPMC Output----------------
Display names for some settings cannot be found. You might be able to
resolve this issue by updating the .ADM files used by Group Policy Management.

Setting State
Software\Microsoft\Windows\CurrentVersion\Policies\System\SynchronousMachineGroupPolicy 1
Software\Microsoft\Windows\CurrentVersion\Policies\System\SynchronousUserGroupPolicy 1
-----------------------

More about : domain gpo applying

Anonymous
February 22, 2005 7:06:03 PM

Archived from groups: microsoft.public.win2000.group_policy (More info?)

"Smurfman" wrote:
> I have a Domain level GPO, with User Config settings to
> execute a Logon
> Script for users. About 1/3 of my users are actually getting
> the script. In
> one instance I ran the GP Result tool from the GPMC to see if
> the policy was
> even working, it shows that this particular policy is denied,
> based on a
> security filter.
>
> I left the policy setting to be the default Authenticated
> Users to Read and
> Apply:
>
> Does this mean that my user was not authenticated at the time
> of logon? And
> that a Cached profile was used to logon?
>
> I also made this change, but can not seem to find it again,
> nor can the
> GPMC...little confused here, but basically when I was reading
> the
> description...it had to do with why it takes 2 logons
> sometimes to process a
> GPO...
>
> Thanks
>
> ---------GPMC Output----------------
> Display names for some settings cannot be found. You might be
> able to
> resolve this issue by updating the .ADM files used by Group
> Policy Management.
>
> Setting State
> SoftwareMicrosoftWindowsCurrentVersionPoliciesSystemSync
> hronousMachineGroupPolicy
> 1
> SoftwareMicrosoftWindowsCurrentVersionPoliciesSystemSync
> hronousUserGroupPolicy
> 1
> -----------------------

Hi,

Make sure DNS is setup correctly. If DNS isn’t working properly it
will cause Group Policy and scripts not to run.
http://www.sd61.bc.ca/windows2000/dns.htm

Cheers,

Lara

--
Posted using the http://www.windowsforumz.com interface, at author's request
Articles individually checked for conformance to usenet standards
Topic URL: http://www.windowsforumz.com/Group-Policy-Domain-GPO-Ap...
Visit Topic URL to contact author (reg. req'd). Report abuse: http://www.windowsforumz.com/eform.php?p=844154
Anonymous
February 22, 2005 7:06:04 PM

Archived from groups: microsoft.public.win2000.group_policy (More info?)

I think I have this one solved, but will monitor it in the morning. In a
related post for Event 1058 and 1030 on XP machines, I notices that certain
users could not gain access to a specific policy that I was referring to in
this post. THe interesting thing ws that the users DID in fact have rights
to the policies in the SYSVOL folder, BUT, it appears that at some time, that
FRS had stopped. No strange entries were in the event log for the File
Replication, and everything reported in the AD Sites, that replication took
place.

The long and short of it, was that there was one policy on one
authentication server missing, and one policy on another that was missing, so
depending on who was authenticated where, determined if the policy was
applied or not, and any changes that were made were also not replicated.
After restarting the service, everything was sync'ed up.

Will keep an eye on it now.

THanks for the reply
J

"lforbes" wrote:

> "Smurfman" wrote:
> > I have a Domain level GPO, with User Config settings to
> > execute a Logon
> > Script for users. About 1/3 of my users are actually getting
> > the script. In
> > one instance I ran the GP Result tool from the GPMC to see if
> > the policy was
> > even working, it shows that this particular policy is denied,
> > based on a
> > security filter.
> >
> > I left the policy setting to be the default Authenticated
> > Users to Read and
> > Apply:
> >
> > Does this mean that my user was not authenticated at the time
> > of logon? And
> > that a Cached profile was used to logon?
> >
> > I also made this change, but can not seem to find it again,
> > nor can the
> > GPMC...little confused here, but basically when I was reading
> > the
> > description...it had to do with why it takes 2 logons
> > sometimes to process a
> > GPO...
> >
> > Thanks
> >
> > ---------GPMC Output----------------
> > Display names for some settings cannot be found. You might be
> > able to
> > resolve this issue by updating the .ADM files used by Group
> > Policy Management.
> >
> > Setting State
> > SoftwareMicrosoftWindowsCurrentVersionPoliciesSystemSync
> > hronousMachineGroupPolicy
> > 1
> > SoftwareMicrosoftWindowsCurrentVersionPoliciesSystemSync
> > hronousUserGroupPolicy
> > 1
> > -----------------------
>
> Hi,
>
> Make sure DNS is setup correctly. If DNS isn’t working properly it
> will cause Group Policy and scripts not to run.
> http://www.sd61.bc.ca/windows2000/dns.htm
>
> Cheers,
>
> Lara
>
> --
> Posted using the http://www.windowsforumz.com interface, at author's request
> Articles individually checked for conformance to usenet standards
> Topic URL: http://www.windowsforumz.com/Group-Policy-Domain-GPO-Ap...
> Visit Topic URL to contact author (reg. req'd). Report abuse: http://www.windowsforumz.com/eform.php?p=844154
>
!