Re: GPO not taking affect
From: Mike Aubert (mikenews2_at_2000trainers.com)
Date: 02/20/04
- Next message: Jeremy Schafer: "Re: How do I force a GPO to get reapplied on a client?"
- Previous message: VictorC: "Services for Unix installation."
- In reply to: lion: "GPO not taking affect"
- Messages sorted by: [ date ] [ thread ]
Date: Fri, 20 Feb 2004 10:04:54 -0600
A GPO is logically made up of two sections - Computer Configuration and User
Configuration. Settings under Computer Configuration affect computer
accounts the GPO applies to and are applied at startup (and then refreshed
periodically). Settings under User Configuration affect user accounts the
GPO applies to and are applied at logon (and then refreshed periodically).
The Computer Configuration section of Group Policy is always pulled based on
the computer account's location in the directory. Additionally, the default
behavior is to pull the User Configuration section of Group Policy based on
the user account's location in the directory. (e.g. half of the Group Policy
settings may come from one set of GPOs whereas the other half come from a
totally different set of GPOs)
This default behavior can be changed by using a feature called loopback
processing. When using loopback processing, the User Configuration portion
of Group Policy is pulled based on the computer account's location in the
directory. Depending on which setting you choose, the GPO settings for User
Configuration based on the location of the computer account can either be
merged with or totally replace the GPO settings for User Configuration based
on the location of the user account (that's a mouth full - let me know if
its unclear). Here is a support article that describes loopback processing
and how to enable it:
http://support.microsoft.com/default.aspx?scid=231287
------------------------------------------------------------------
Mike Aubert
MCSE, MCSD, MCDBA
mikenews2@2000trainers.com
Note the "news2" in my email address is temporary and may be changed in the
future, remove it to email me at my Permanente address.
This posting is provided "AS IS" with no warranties, and confers no rights.
"lion" <anonymous@discussions.microsoft.com> wrote in message
news:13c4f01c3f7c2$5e850d80$a401280a@phx.gbl...
> Ive got a w2k server as a member server in w2k domain. Im
> using terminal service for certain vpn clients to access.
> Ive created a OU for this server and its the only pc in
> the OU.
> When i create a GPO for this server and link it to the
> OU, where i disalow quite a lot of features,ie cant
> browse the network.. The GPO settings do not take affect.
> Ive got no other GPOs linked to that OU. Ive tried
> blocking inheritance, no over ride, still it does not
> affect the users who log in. Another thing is that i set
> the apply policy option in security to apply to only a
> group, with users who need these restrictions.
> Can some one help me. If i go through local policies
> indtead of creating it at the domain level, im not sure i
> can filter it to specific users.
- Next message: Jeremy Schafer: "Re: How do I force a GPO to get reapplied on a client?"
- Previous message: VictorC: "Services for Unix installation."
- In reply to: lion: "GPO not taking affect"
- Messages sorted by: [ date ] [ thread ]
Relevant Pages
|
