Re: HELP! No GPO in effect, but restrictions still apply

Tech-Archive recommends: Speed Up your PC by fixing your registry

From: Jeff (Jeff_at_discussions.microsoft.com)
Date: 01/22/05 

Date: Sat, 22 Jan 2005 07:53:03 -0800

Thanks Lara. No local policies are in effect, and this situation is
affecting multiple machines. New workstations, and new 2003 servers. When
they're freshly loaded, they're fine, and as soon as they join the domain the
restrictions apply, before they're moved from the default container. I'm
logging on with an unrestricted administrator account, and even created
another account to ensure there were no restrictions.

Thoughts?

"lforbes" wrote:

> "Jeff159" wrote:
> > OK, this one's REALLY strange. Please help!
> >
> > Environment...
> >
> > Windows 2003 Server, all critical updates applied
> > XP Pro SP2 desktops, all critical updates applied
> >
> > Situation...
> >
> > Everything was working fine from a Group Policy perspective
> > until today. I
> > just added a new workstation to the domain, and upon reboot I
> > noticed that
> > specific Group Policy restrictions were being applied, despite
> > the fact that
> > I hadn't yet moved the workstation to an OU where I have the
> > GPOs are
> > defined. More specifically, restrictions from different GPOs
> > linked to
> > different OUs are being applied, despite the fact that the
> > workstation
> > remains in the default "Computers" container in AD. The only
> > GPO that should
> > be applied at this point is the Default Domain Policy, which
> > is unmodified,
> > and contains none of the restrictions I'm seeing.
> >
> > I ran gpresult on the workstation and confirmed that indeed
> > nothing but the
> > Default Domain Policy is listed, yet the restrictions that are
> > specifically
> > defined in the other GPOs are in effect.
> >
> > I've spent hours combing through the policies and can find
> > nothing out of
> > the ordinary. The Default Domain Profile definitely does not
> > contain the
> > restrictions I'm seeing. I've even gone so far as to disable
> > EVERY GPO on my
> > server, including the Default Domain Profile, rebooted the
> > server, rebooted
> > the workstation, and still the restrictions remain in effect.
> > Gpresult
> > confirms that NO Group Policy is applying whatsoever, yet the
> > restrictions
> > remain in effect.
> >
> > So I've asked myself "what's changed" since the OU and GPO
> > structure was
> > working properly. The only thing that's different is that I
> > ran Windows
> > Update on the server and I believe there were 3 critical
> > updates this past
> > week. Other than that there have been no changes. No new
> > software, no
> > configuration changes, nothing.
> >
> > The answer is there, I just don't see it. Someone please show
> > me the light.
>
> Hi,
>
> Did you check the Local Security Policy on the local machine? IF
> there are settings here that don’t conflict with Group Policies then
> they WILL Apply. Also, run gpedit.msc (local group policy) and see
> what is there.
> More than likely there is a local setting set and that is why it is
> affecting this workstation.
>
> Cheers,
>
> Lara
>
> --
> Posted using the http://www.windowsforumz.com interface, at author's request
> Articles individually checked for conformance to usenet standards
> Topic URL: http://www.windowsforumz.com/Group-Policy-HELP-GPO-effect-restrictions-apply-ftopict254243.html
> Visit Topic URL to contact author (reg. req'd). Report abuse: http://www.windowsforumz.com/eform.php?p=783131
>

Relevant Pages

  • Re: GPO doesnt apply to workstations.
    ... > other 2 settings are user settings. ... Running GPResult on the workstation shows that the local group ... not the GPO I designed on the server. ... >> mentions loopback processing of group policy, and I tried, but no luck. ...
    (microsoft.public.win2000.group_policy)
  • HELP! No GPO in effect, but restrictions still apply
    ... Windows 2003 Server, all critical updates applied ... I hadn't yet moved the workstation to an OU where I have the GPOs are ...
    (microsoft.public.win2000.group_policy)
  • Re: Adding accounts to group doesnt work
    ... Restricted groups with in a Group Policy allow to map membership: ... > I have strange situation.There is DC on Windows 2003 server. ... > administrator group of every workstation. ...
    (microsoft.public.windows.server.active_directory)
  • Re: GP Result "componant error"
    ... I removed the Software installation GPO from the Group Policy ... Server, against the Workstation and saw the componant error with the ...
    (microsoft.public.windows.group_policy)
  • Re: Help in setting up LAN with Server 2003
    ... This is really an Active Directory and Group Policy ... of the DNS service on your server ... > I am setting up a new LAN and I need advice on accomplishing the following ... > password via the Server to gain access to the workstation and ability to ...
    (microsoft.public.windowsxp.security_admin)