Re: GPO Question
From: Mark Renoden [MSFT] (markreno_at_online.microsoft.com)
Date: 07/08/04
- Next message: aken: "restrict custom application for domain users"
- Previous message: Brian Desmond [MVP]: "Re: lockdown ie with ad"
- In reply to: David: "Re: GPO Question"
- Next in thread: David: "Re: GPO Question"
- Reply: David: "Re: GPO Question"
- Messages sorted by: [ date ] [ thread ]
Date: Fri, 9 Jul 2004 07:55:35 +1000
Hi David
If you only have the computer account in the OU, the User Configuration half
of the policy won't apply. If you want the User Configuration portion to
apply to the user who is logging in, that user must reside in that OU.
Alternatively, don't set User Configuration options in that policy and
instead create another policy linked to the OU in which the user resides.
In summary, Computer Configuration only applies to computers and User
Configuration to users. The computers or users must be in the OU (or in the
OU heirarchy below) to which the GPO is linked for it to apply.
Kind regards
-- Mark Renoden [MSFT] Windows Platform Support Team Email: markreno@online.microsoft.com Please note you'll need to strip ".online" from my email address to email me; I'll post a response back to the group. This posting is provided "AS IS" with no warranties, and confers no rights. "David" <David@discussions.microsoft.com> wrote in message news:CF554F40-71C1-420E-9EEC-9CF79FF5F234@microsoft.com... > hi! > > i don't quite get you on > "you might only have the computer account in the OU and the user is > somewhere > else and as such, not receiving the policy." For my current config, the > objects in that OU are computer not user. Do, you meant i need to ceate > the user name in that OU as well? > > I've tried the gpresult command. The testxp-user gpo is applied. > Followings is the output : > > he user received "Registry" settings from these GPOs: > > Default Domain Policy > > > > ############################################################### > > Computer Group Policy results for: > > CN=OIP-DESKTOP-012,OU=TestOU,DC=smcsg,DC=com > > Domain Name: SMCSG > Domain Type: Windows 2000 > Site Name: 6th-Serangoon > > > The computer is a member of the following security groups: > > BUILTIN\Administrators > \Everyone > OIP-DESKTOP-012\Debugger Users > BUILTIN\Users > SMCSG\OIP-DESKTOP-012$ > SMCSG\Domain Computers > NT AUTHORITY\NETWORK > NT AUTHORITY\Authenticated Users > > ############################################################### > > Last time Group Policy was applied: Thursday, July 08, 2004 at 10:27:21 AM > Group Policy was applied from: smcsg-pdc.smcsg.com > > > =============================================================== > > > The computer received "Registry" settings from these GPOs: > > Local Group Policy > Default Domain Policy > > > =============================================================== > The computer received "Security" settings from these GPOs: > > Local Group Policy > Default Domain Policy > > > =============================================================== > The computer received "EFS recovery" settings from these GPOs: > > Local Group Policy > Default Domain Policy > testxp-user > > > =============================================================== > The computer received "Application Management" settings from these GPOs: > > testxp-user > > > "Mark Renoden [MSFT]" wrote: > >> Hi David >> >> The Computer Configuration portion applies to computers that reside in >> the >> OU to which the GPO is linked. The User Configuration portion applies to >> users that reside in the OU to which the GPO is linked. It sounds like >> you >> might only have the computer account in the OU and the user is somewhere >> else and as such, not receiving the policy. >> >> You can run the following at a command prompt to see what is applied and >> from where: >> >> gpresult /z >> >> I often output it to a text file and read in notepad >> >> gpresult /z > gp.txt >> >> It's useful because (for the computer and the user) it tells you which >> which >> OU you're in, which GPO's were applied, which were filtered out and why, >> and >> the specific settings effected by policy and which specific GPO they were >> applied from. >> >> Kind regards >> -- >> Mark Renoden [MSFT] >> Windows Platform Support Team >> Email: markreno@online.microsoft.com >> >> Please note you'll need to strip ".online" from my email address to email >> me; I'll post a response back to the group. >> >> This posting is provided "AS IS" with no warranties, and confers no >> rights. >> >> "David" <David@discussions.microsoft.com> wrote in message >> news:4E5D2F4C-2E59-42B8-BDC4-11E1DF0D78EF@microsoft.com... >> > hi! >> > >> > I configured some of the settings in the computer >> > configuration(OfficeXP >> > administrative point) and user configuration(don't run this windows >> > application). The don't run this application part doesn't work but the >> > computer configuration part is functioning well. Any idea what's the >> > problem? is it becoz the same GPO can't have both user and computer >> > configuration configured? >> > >> > Thks! >> >> >>
- Next message: aken: "restrict custom application for domain users"
- Previous message: Brian Desmond [MVP]: "Re: lockdown ie with ad"
- In reply to: David: "Re: GPO Question"
- Next in thread: David: "Re: GPO Question"
- Reply: David: "Re: GPO Question"
- Messages sorted by: [ date ] [ thread ]
Relevant Pages
|
