[gptalk] Re: Not all Group Policy settings being applied
- From: "Alan & Margaret" <syspro@xxxxxxxxxxxxxxxx>
- To: <gptalk@xxxxxxxxxxxxx>
- Date: Thu, 8 Mar 2007 08:34:12 +1100
Hi Pierre,
One thing that might be catching you is if you have not enabled "process
even if the group Policy Objects have not changed" under
"Machine\Administrative templates\system\group Policy\registry policy
processing". The default is to only process it if the group policy changes.
This means that if the setting is wrong, it will remain wrong until the
policy changes. You can run "GPUPDATE /Force" which will reapply all
policies unconditionally to see if this fixes the problem. If this is the
case, we can work out why the machine thought the policy was already
applied.
If this is not the problem, go for the UserEnv Log!
You can enable logging and check out the log to find out:-
1. Is the Policy being detected in the OU structure?
2. Is it passing security filtering?
3. Is it attempting to apply the ADM component of the policy?
4. Is it trying to apply the registry key that was expected?
You can then check if the registry key is actually in place
Failure at any one of these levels could cause the problem.
You can checkout http://support.microsoft.com/kb/221833/en-us to see how to
enable logging.. Or you can download and install my Policy Log Reporter (see
below). By default it checks the machine it is installed on, but you can
also point it at a remote machine. It provides a button to enable logging
and it will parse the log and show it in a more structured way.
If you still can't understand what is going on, post the log and we can
check it out for you.
Alan Cuthbertson
Policy Management Software:-
http://www.sysprosoft.com/index.php?ref=activedir
<http://www.sysprosoft.com/index.php?ref=activedir&f=pol_summary.shtml>
&f=pol_summary.shtml
ADM Template Editor:-
http://www.sysprosoft.com/index.php?ref=activedir
<http://www.sysprosoft.com/index.php?ref=activedir&f=adm_summary.shtml>
&f=adm_summary.shtml
Policy Log Reporter(Free)
http://www.sysprosoft.com/index.php?ref=activedir
<http://www.sysprosoft.com/index.php?ref=activedir&f=policyreporter.shtml>
&f=policyreporter.shtml
_____
From: gptalk-bounce@xxxxxxxxxxxxx [mailto:gptalk-bounce@xxxxxxxxxxxxx] On
Behalf Of pierre.camilleri@xxxxxxxxxxxxxxx
Sent: Thursday, 8 March 2007 2:42 AM
To: gptalk@xxxxxxxxxxxxx
Subject: [gptalk] Not all Group Policy settings being applied
Hi Everyone!
I am encountering a problem on certain Windows XP Pro (SP2) workstations
where not all settings of the W2K3 group policy are being applied. The
setting which is not being applied is the Windows Automatic Updates. It is
company policy to disable automatic download of MS updates. The majority of
our workstations are having this policy setting applied correctly but some
are not having this setting applied. They are having other settings applied
e.g. disabling the Run command, etc., but not this one. All the workstations
belong to the same AD domain and all have a common group policy.
Has anyone encountered this problem before? Any comments/help would be very
much appreciated.
Thanks in advance
Pierre
Other related posts:
