Re: How do I permanently remove from Active Directory, a package that was assigned to a computer?

OK, I'm really trying to clean this thing up and need some suggestions.
Here is how it was:

We have two offices, 15 miles apart. (Columbia and Laurel) One office
has 150 PCs and the other has 30, so we aren't talking about a huge
enterprise here.

When a computer is added to the domain it is left in the default
Computers container and is added to either the "Columbia Computers" or
"Laurel Computers" group that is also in that container. When a new user is
created, they are added to default Users container and either the "Columbia
Users" or "Laurel Users" distribution group.

We had a number of group policies that had been created at the domain
level. Depending on which office the settings in the policy applied to, we
would only allow "Read" and "Apply Policy" permissions on the security of
the policy for either the Laurel user and computer groups or the Columbia
user and computer groups. Some policies had computer settings others had
user settings which is why we would apply the different groups.

I have since made an OU called IMS. Under this OU, I made two other OUs
called Columbia and Laurel. At the IMS OU, I made a new group policy for
settings applied to both offices, but not the domain controllers (WSUS). On
the Columbia and Laurel OUs I made new policies for the settings that
correspond to that location.

I then moved the two Columbia and two Laurel groups into their new OUs.
Running GPResult on one of the PCs shows that those policies are never
applied, just the policies that are still at the domain level. I tried
gpupdate /force then rebooted but the behavior was the same. If I instead
move a specific computer and a specific user from the computer and users
containers, the policies do get applied.

Should this setup work? Is it even the ideal setup? Block inheritance
is not set anywhere. Given that the policies are applied if a specfic
computer or user is listed rather than a group, it doesn't seem like the
policies are being blocked.

Steve

"Steve Stormont" <stormonts@xxxxxxxxxx> wrote in message
news:OoDCxvKfFHA.572@xxxxxxxxxxxxxxxxxxxxxxx
> Looks like it. I think it's time to clean some things up.
>
> So, I made an OU for our office called Columbia. Should I now just
> move each of the computers from the default Computers container to the new
> Columbia OU? There is no way (or is it even necessary) to make a
> Computers container in the new Columbia OU? After those are all moved,
> then make a new Group Policy at the Columbia OU level, right?
>
> Thanks for the help
>
> Steve
>
> "Ken B" <none@xxxxxxxxxxxxx> wrote in message
> news:eQSyPKKfFHA.2372@xxxxxxxxxxxxxxxxxxxxxxx
>> You've applied your Office XP installation policy at the domain level?
>>
>>
>> "Steve Stormont" <stormonts@xxxxxxxxxx> wrote in message
>> news:%23Ts96IGfFHA.3960@xxxxxxxxxxxxxxxxxxxxxxx
>>> Not sure I understand what to do. The computers are in the default
>>> "Computers" container. Do I need to make a new container, move the PCs
>>> in question to that container, and then move them back?
>>>
>>> Steve
>>>
>>> Denis Wong @ Hong Kong wrote:
>>>> Hi Steve,
>>>>
>>>> One simple method is to move the computer objects out of the OU with
>>>> the GPO
>>>> and into another OU. The installation should be uninstalled on the next
>>>> reboot.
>>>>
>>>> br,
>>>> Denis
>>>>
>>>> "Steve Stormont" <stormonts@xxxxxxxxxx> wrote in message
>>>> news:uKHfkfFfFHA.2484@xxxxxxxxxxxxxxxxxxxxxxx
>>>>
>>>>>I made a group policy called "Deploy Office XP". In this policy, I
>>>>>created a package for Office XP deployment which I assigned to a number
>>>>>of computers in our office. Office XP is installed to those computers
>>>>
>>>> fine.
>>>>
>>>>>Now, say I want to assign Office 2003 to the same PCs and no longer
>>>>>want to have them install Office XP, how do I remove the assigned
>>>>>Office
>>>>>XP package from Active Directory so that it will no longer be installed
>>>>>(if necessary) on these PCs at boot? (I don't even want Office XP
>>>>>"advertised" on the PCs it was assigned to anymore, either) Since as
>>>>>soon as I created the assigned package it disappears from the "Computer
>>>>>Configuration" -> "Software Settings" -> "Software installation", is
>>>>>the
>>>>>only way to delete the "Deploy Office XP" group policy and then make a
>>>>>new policy called "Deploy Office 2003" and assign the Office 2003
>>>>>package to those PCs?
>>>>>
>>>>>Steve
>>>>
>>>>
>>
>
>


.

Relevant Pages
Loading