[THIN] Re: Weird W2K3 GPO issues

  • From: "Greg Reese" <gareese@xxxxxxxxx>
  • To: thin@xxxxxxxxxxxxx
  • Date: Mon, 30 Jun 2008 20:44:02 -0500

make sure you seed your mandatory profile pre-GPO so you don't accidentally
tattoo it with bad stuff.

Regmon can help with identifying any permission issues.  Just set the filter
to "policies"  and highlight "denied" while logged on as local admin.  Then
login with the account you are testing with from another session.  Regmon
shoudl catch any permission problems.

It probably isn't permissions, but at least this rules it out quickly and
easily so later you aren't smacking yourself in the head about it.

On Mon, Jun 30, 2008 at 8:19 PM, Steve Snyder <kwajalein@xxxxxxxxx> wrote:

> Read & Apply
>
> Seems to be related to my mandatory profile, I'll have to pick it apart a
> bit
>
>
> On Tue, Jul 1, 2008 at 12:57 PM, Joe Shonk <joe.shonk@xxxxxxxxx> wrote:
>
>>  Do the users have read permission but not apply?
>>
>>
>>
>> Joe
>>
>>
>>
>> *From:* thin-bounce@xxxxxxxxxxxxx [mailto:thin-bounce@xxxxxxxxxxxxx] *On
>> Behalf Of *Steve Snyder
>> *Sent:* Monday, June 30, 2008 3:55 PM
>> *To:* thin@xxxxxxxxxxxxx
>> *Subject:* [THIN] Weird W2K3 GPO issues
>>
>>
>>
>> new build of W2K3R2, all current M$ patches. Server resides in an OU
>> blocking GPO inheritance, and I have a GPO applied to this OU with very
>> minimal settings for testing using loopback to force user settings. When I
>> logon with a dummy user account (my daily account :) ) the policy settings
>> don't apply (remove shutdown, disable CMD, etc.) but if I run a rsop.msc it
>> shows the settings as being applied. If I make my dummy account a local
>> admin on the box then the settings apply. I've enabled debugging and see
>> entries like
>>
>> USERENV(16fc.15b4) 10:43:09:525 SetRegistryValue: DisableRegistryTools =>
>> 1  [OK]
>>
>> and in the user's registry key
>> software\microsoft\windows\currentversion\policies\system the values are set
>> properly, they're just not working.
>>
>> Any thoughts or ideas on whree to look next?
>>
>
>

Other related posts: