[gptalk] Re: GPO being applied after a lengthy delay

  • From: "Alan & Margaret" <syspro@xxxxxxxxxxxxxxxx>
  • To: <gptalk@xxxxxxxxxxxxx>
  • Date: Mon, 27 Oct 2008 08:18:48 +1100

Hi Dilan,

 

Are you using IE Maintenance or an Admin Template to do it?

 

The default setting is to reapply policies only if the policy has changed.
You can go in to "Machine\Admin templates\System\Group Policy\Internet
Explorer Maintenance" and "Machine\Admin templates\System\Group
Policy\Registry Policy Processing" and change it to always reapply policy
but this will cause a small performance hit.

 

My preference is to always reapply all of the policy settings but increase
the Policy Refresh Interval (Machine\Admin templates\System\Group
Policy\Group Policy Refresh interval) to more than 8 hours, so policy
effectively only gets applied once when you logon. If you don't do this you
will often run in to situations were a setting is reversed either by an
installation or by someone with ADMIN rights and will not get corrected
until a policy changes or a gpupdate /force is used.

 

You could add a new policy with a WMI filter on it for IE7. This will then
get applied with the next GPO processing cycle after the IE7 upgrade.

 

Of course the new Policy Preference Settings can help you out as well.

 

Note: As mentioned by Darren recently, be careful about using more than one
Extension (IE maintenance/Admin Templates/Policy Preferences/scripts) to
manage the same setting. 

 

Alan Cuthbertson

 

 

 Policy Management Software (Now with ADMX and Preference support):-

http://www.sysprosoft.com/index.php?ref=activedir
<http://www.sysprosoft.com/index.php?ref=activedir&f=pol_summary.shtml>
&f=pol_summary.shtml

 

ADM Template Editor(Now with ADMX support):-

http://www.sysprosoft.com/index.php?ref=activedir
<http://www.sysprosoft.com/index.php?ref=activedir&f=adm_summary.shtml>
&f=adm_summary.shtml

 

Policy Log Reporter(Free)

http://www.sysprosoft.com/index.php?ref=activedir
<http://www.sysprosoft.com/index.php?ref=activedir&f=policyreporter.shtml>
&f=policyreporter.shtml

 

 

 

 

-----Original Message-----
From: gptalk-bounce@xxxxxxxxxxxxx [mailto:gptalk-bounce@xxxxxxxxxxxxx] On
Behalf Of Dilan Arumainathan
Sent: Monday, 27 October 2008 6:49 AM
To: gptalk@xxxxxxxxxxxxx
Subject: [gptalk] GPO being applied after a lengthy delay

 

Hi everyone, 

I am upgrading desktop broswers from IE6 to IE7. We have an existing GPO
that pushes a proxy server address to a certain group of users. After the
browser upgrade this proxy setting is missing until the users manually run
"gpupdate /force". Reboots don't help either. I thought reboots cause the
GPOs to be refreshed(?).

 

Running gpresult shows that the GPO was being applied as a user setting. 

 

Any ideas on how I can troubleshoot this further?

 

 

      

***********************

You can unsubscribe from gptalk by sending email to
gptalk-request@xxxxxxxxxxxxx with 'unsubscribe' in the Subject field OR by
logging into the freelists.org Web interface. Archives for the list are
available at http://www.freelists.org/archives/gptalk/

************************

Other related posts: