Please help, "security settings" in GPO for default domain policy does not get processed

From: jacques koorts (jkoorts_at_ccalimited.com)
Date: 07/07/04

Next message: Corey: "Re: Allowing users to "Unplug or Eject Hardware""

Previous message: anonymous: "added new ou with same group policy"
Next in thread: jacques koorts: "Re: Please help, "security settings" in GPO for default domain policy does not get processed"
Reply: jacques koorts: "Re: Please help, "security settings" in GPO for default domain policy does not get processed"
Messages sorted by: [ date ] [ thread ]

Date: Wed, 7 Jul 2004 16:24:36 -0400

Hi, I have run out of ideas why this does not work.

I've added registry settings in "security settings">registry. Went to client
and run secedit and even rebooted, but no effect on client - the entries
does not get written.

gpresult produces no clues.

I went and changed account policies - same problem, does not processed and
gpresult says nothing.

I went and add a script to "windows settings">scripts, that worked, and
gpresult did report on it.

I went and made some changes in "Administrative templates>Windows
components>Windows Update". This does get processed, and my clients updates
nicely from SUS. GPresult shows that this gets processed.

What the hell is wrong?!

Any suggestions anyone?

The keys I want to add is (I'm pasting from my .reg file) is:

[HKEY_CLASSES_ROOT\jkAD.WSC]
@="jkAD"

[HKEY_CLASSES_ROOT\jkAD.WSC\CLSID]
@="{30FD2C9B-F4B4-4948-B18B-95986FC055D3}"

Here my gpresult:

Microsoft (R) Windows (R) 2000 Operating System Group Policy Result tool
Copyright (C) Microsoft Corp. 1981-1999

Created on Wednesday, July 07, 2004 at 4:25:02 PM

Operating System Information:

Operating System Type: Professional
Operating System Version: 5.0.2195.Service Pack 4
Terminal Server Mode: Not supported

###############################################################

User Group Policy results for:

CN=reception,OU=frontdesk,DC=tbh,DC=com

  Domain Name: TBH
  Domain Type: Windows 2000
  Site Name: Default-First-Site

Roaming profile: \\file-tbh\reception$\profile
Local profile: C:\Documents and Settings\reception

The user is a member of the following security groups:

TBH\Domain Users
\Everyone
BUILTIN\Users
NT AUTHORITY\INTERACTIVE
NT AUTHORITY\Authenticated Users
\LOCAL
TBH\FrontDesk

The user has the following security privileges:

Bypass traverse checking
Shut down the system
Remove computer from docking station

###############################################################

Last time Group Policy was applied: Wednesday, July 07, 2004 at 4:24:08 PM
Group Policy was applied from: file-tbh.tbh.com

===============================================================
The user received "Internet Explorer Branding" settings from these GPOs:

Default Domain Policy
     Revision Number: 2
     Unique Name: {31B2F340-016D-11D2-945F-00C04FB984F9}
     Domain Name: tbh.com
     Linked to: Domain (DC=tbh,DC=com)

Additional information is not available for this type of policy setting.

###############################################################

Computer Group Policy results for:

CN=FRONTDESK4,CN=Computers,DC=tbh,DC=com

  Domain Name: TBH
  Domain Type: Windows 2000
  Site Name: Default-First-Site

The computer is a member of the following security groups:

BUILTIN\Administrators
\Everyone
BUILTIN\Users
TBH\FRONTDESK4$
TBH\Domain Computers
NT AUTHORITY\NETWORK
NT AUTHORITY\Authenticated Users

###############################################################

Last time Group Policy was applied: Wednesday, July 07, 2004 at 4:23:37 PM
Group Policy was applied from: file-tbh.tbh.com

===============================================================

The computer received "Registry" settings from these GPOs:

Local Group Policy
     Revision Number: 3
     Unique Name: Local Group Policy
     Domain Name:
     Linked to: Local computer

Default Domain Policy
     Revision Number: 29
     Unique Name: {31B2F340-016D-11D2-945F-00C04FB984F9}
     Domain Name: tbh.com
     Linked to: Domain (DC=tbh,DC=com)

The following settings were applied from: Local Group Policy

     KeyName: Software\Policies\Microsoft\SystemCertificates\EFS
     ValueName: EFSBlob
     ValueType: REG_BINARY
     Value: Binary data. Use the /S switch to display.

     KeyName:
Software\Policies\Microsoft\SystemCertificates\EFS\Certificates\92992C8905B8
24FF11F7E7D7EB6E1F3FDFEA5C67
     ValueName: Blob
     ValueType: REG_BINARY
     Value: Binary data. Use the /S switch to display.

     KeyName: Software\Policies\Microsoft\SystemCertificates\EFS\CRLs
     ValueName:
     ValueType: REG_NONE
     Value: This key contains no values

     KeyName: Software\Policies\Microsoft\SystemCertificates\EFS\CTLs
     ValueName:
     ValueType: REG_NONE
     Value: This key contains no values

The following settings were applied from: Default Domain Policy

     KeyName: Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
     ValueName: NoWelcomeScreen
     ValueType: REG_DWORD
     Value: 0x00000001

     KeyName:
Software\Policies\Microsoft\SystemCertificates\ACRS\Certificates
     ValueName:
     ValueType: REG_NONE
     Value: This key contains no values

     KeyName: Software\Policies\Microsoft\SystemCertificates\ACRS\CRLs
     ValueName:
     ValueType: REG_NONE
     Value: This key contains no values

     KeyName: Software\Policies\Microsoft\SystemCertificates\ACRS\CTLs
     ValueName:
     ValueType: REG_NONE
     Value: This key contains no values

     KeyName: Software\Policies\Microsoft\SystemCertificates\EFS
     ValueName: EFSBlob
     ValueType: REG_BINARY
     Value: Binary data. Use the /S switch to display.

     KeyName:
Software\Policies\Microsoft\SystemCertificates\EFS\Certificates\E4EC6490BDFC
BDD767193E83B5F243689F4A545B
     ValueName: Blob
     ValueType: REG_BINARY
     Value: Binary data. Use the /S switch to display.

     KeyName: Software\Policies\Microsoft\SystemCertificates\EFS\CRLs
     ValueName:
     ValueType: REG_NONE
     Value: This key contains no values

     KeyName: Software\Policies\Microsoft\SystemCertificates\EFS\CTLs
     ValueName:
     ValueType: REG_NONE
     Value: This key contains no values

     KeyName:
Software\Policies\Microsoft\SystemCertificates\Root\Certificates
     ValueName:
     ValueType: REG_NONE
     Value: This key contains no values

     KeyName: Software\Policies\Microsoft\SystemCertificates\Root\CRLs
     ValueName:
     ValueType: REG_NONE
     Value: This key contains no values

     KeyName: Software\Policies\Microsoft\SystemCertificates\Root\CTLs
     ValueName:
     ValueType: REG_NONE
     Value: This key contains no values

     KeyName:
Software\Policies\Microsoft\SystemCertificates\Trust\Certificates
     ValueName:
     ValueType: REG_NONE
     Value: This key contains no values

     KeyName: Software\Policies\Microsoft\SystemCertificates\Trust\CRLs
     ValueName:
     ValueType: REG_NONE
     Value: This key contains no values

     KeyName: Software\Policies\Microsoft\SystemCertificates\Trust\CTLs
     ValueName:
     ValueType: REG_NONE
     Value: This key contains no values

     KeyName: Software\Policies\Microsoft\Windows\Group
Policy\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}
     ValueName: NoBackgroundPolicy
     ValueType: REG_DWORD
     Value: 0x00000000

     KeyName: Software\Policies\Microsoft\Windows\Group
Policy\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}
     ValueName: NoGPOListChanges
     ValueType: REG_DWORD
     Value: 0x00000000

     KeyName: Software\Policies\Microsoft\Windows\System
     ValueName: AddAdminGroupToRUP
     ValueType: REG_DWORD
     Value: 0x00000001

     KeyName: Software\Policies\Microsoft\Windows\WindowsUpdate
     ValueName: WUServer
     ValueType: REG_SZ
     Value: http://file-tbh

     KeyName: Software\Policies\Microsoft\Windows\WindowsUpdate
     ValueName: WUStatusServer
     ValueType: REG_SZ
     Value: http://file-tbh

     KeyName: Software\Policies\Microsoft\Windows\WindowsUpdate\AU
     ValueName: RescheduleWaitTime
     ValueType: REG_DWORD
     Value: 0x00000005

     KeyName: Software\Policies\Microsoft\Windows\WindowsUpdate\AU
     ValueName: NoAutoRebootWithLoggedOnUsers
     ValueType: REG_DWORD
     Value: 0x00000001

     KeyName: Software\Policies\Microsoft\Windows\WindowsUpdate\AU
     ValueName: NoAutoUpdate
     ValueType: REG_DWORD
     Value: 0x00000000

     KeyName: Software\Policies\Microsoft\Windows\WindowsUpdate\AU
     ValueName: AUOptions
     ValueType: REG_DWORD
     Value: 0x00000004

     KeyName: Software\Policies\Microsoft\Windows\WindowsUpdate\AU
     ValueName: ScheduledInstallDay
     ValueType: REG_DWORD
     Value: 0x00000000

     KeyName: Software\Policies\Microsoft\Windows\WindowsUpdate\AU
     ValueName: ScheduledInstallTime
     ValueType: REG_DWORD
     Value: 0x0000000f

     KeyName: Software\Policies\Microsoft\Windows\WindowsUpdate\AU
     ValueName: UseWUServer
     ValueType: REG_DWORD
     Value: 0x00000001

===============================================================
The computer received "Scripts" settings from these GPOs:

Default Domain Policy
     Revision Number: 29
     Unique Name: {31B2F340-016D-11D2-945F-00C04FB984F9}
     Domain Name: tbh.com
     Linked to: Domain (DC=tbh,DC=com)

Startup scripts specified in: Default Domain Policy
login.vbs

===============================================================
The computer received "Security" settings from these GPOs:

Local Group Policy
     Revision Number: 3
     Unique Name: Local Group Policy
     Domain Name:
     Linked to: Local computer

Default Domain Policy
     Revision Number: 29
     Unique Name: {31B2F340-016D-11D2-945F-00C04FB984F9}
     Domain Name: tbh.com
     Linked to: Domain (DC=tbh,DC=com)

Run the Security Configuration Editor for more information.

===============================================================
The computer received "EFS recovery" settings from these GPOs:

Local Group Policy
     Revision Number: 3
     Unique Name: Local Group Policy
     Domain Name:
     Linked to: Local computer

Default Domain Policy
     Revision Number: 29
     Unique Name: {31B2F340-016D-11D2-945F-00C04FB984F9}
     Domain Name: TBH.COM
     Linked to: Domain (DC=tbh,DC=com)

Additional information is not available for this type of policy setting.

Next message: Corey: "Re: Allowing users to "Unplug or Eject Hardware""

Previous message: anonymous: "added new ou with same group policy"
Next in thread: jacques koorts: "Re: Please help, "security settings" in GPO for default domain policy does not get processed"
Reply: jacques koorts: "Re: Please help, "security settings" in GPO for default domain policy does not get processed"
Messages sorted by: [ date ] [ thread ]

Relevant Pages

RE: Several Problems; how to reset security and troubleshoot serve
... On the SBS security settings; I accept your response, ... On the Remote Assistance Issue I have check all of the settings as you ... What started me on the path of security problem was I had a simular problem ... Start the Microsoft Management Console Group Policy snap-in. ...
(microsoft.public.windows.server.sbs)
Re: Windows Update Error on XP 64bit: update is redirected from v6
... Proxycfg settings WORKED. ... Microsoft Windows 2000 Operating System Group Policy Result tool ... The user is a member of the following security groups: ...
(microsoft.public.windowsupdate)
Re: Active Directory design
... We have 5 main depts (Management, Middle Office, Marketing, Finance, Operations) plus a number of general admin staff that dont really belong to any dept. ... The only group policy settings I am planning to define are those to do with password security and workstation screensavers. ... If I do create the user accounts in the default 'Users' container, will the defualt domain policy work on users in this container? ...
(microsoft.public.win2000.active_directory)
Re: Problems configuring security for services
... Do you know of any good references for setting permissions ... >> and Security Templates on a Windows 2000 Advanced Server ... settings to try to ... >the group policy back to the state of a fresh new install ...
(microsoft.public.win2000.security)
Re: Problems configuring security for services
... I would think that the permissions you describe should be fine. ... thought that those permissions on the services in the Group Policy were ... you see what's wrong by looking in the Windows security Event Log. ... > settings to try to reset ...
(microsoft.public.win2000.security)