Strange GPO permissions problem

From: Dave Glick (dancies_at_patriot.net)
Date: 10/28/04 

Date: 28 Oct 2004 06:50:13 -0700

Hi,

I have a very strange GPO permissions problem that, for the life of
me, I can't get to the bottom of. I've tried just about everything I
can think of and spent countless hours researching online to no avail.
In any case, here's the situation.

I have a fairly simple small business setup with one AD DC running
SBS2003 and two other Win 2003 servers (a file server and a web
server). I also have about 15 clients - all XP (about two thirds are
currently SP2). The problem is happening on one (and only one as far
as I can tell) of the clients (which is running SP2). All domain users
can see the network okay (as in going into My Network Places) and
access shares on other computers. However, only full admins can browse
the web or access email (through Outlook connecting to our SBS2003
Exchange server). Normal domain users can't do either of these things.
As soon as I add a user to the "Domain Administrators" group, they can
go about business as usual.

Two things of note. The first is that the normal domain users don't
experience this problem on any of our other clients. This leads me to
believe that the problem is at least in part specific to this one
computer (or perhaps some computer-specific setting in AD). The second
is that I get repeated Userenv errors in the event log - mainly 1058,
1030, 1065, and 1104. I also have a copy of a verbose userenv.log
trace if anyone thinks it might help.

I've tried a whole bunch of stuff including joining and unjoining the
computer from the domain in multiple ways (deleting from AD, doing
through the client, etc), refreshing through ipconfig, starting and
stopping various services (such as TCP/IP NetBIOS helper), and
removing and readding network interfaces. File and Print Sharing is
also enabled (since I know that's sometimes a source of similar
problems).

I'm about at wits end - I'm hoping someone can help!

-Dave Glick
dancies@patriot.net

Relevant Pages

  • RE: Printing from Win9x clients stops
    ... > and make sure this software does not interfere with SBS Server. ... > clients, please disable it and try again. ... Create a local printer and redirect the port to the network server. ...
    (microsoft.public.windows.server.sbs)
  • Re: ISA Server & a WiFi Hotspot (some DHCP for good measure too)
    ... ISA2k4 is currently not supported on SBS ... To review - you have LAN clients that you want to have ... card for your server. ... > network with 5 client computers. ...
    (microsoft.public.windows.server.sbs)
  • RE: Users Cant Access Documents on Server
    ... Thanks for using the SBS newsgroup. ... As well as we know, if a workstation would not access network shares, then ... Leave the Default Gateway of the internal NIC blank of the server box. ... Clients That Require SMB Signing ...
    (microsoft.public.windows.server.sbs)
  • ie 6.0
    ... > laptop moves from one network to another, its IP address lease might need ... > request might go to a different server that will not extend the lease ... > for a period of time, it will not provide the time to requesting clients. ...
    (microsoft.public.windows.inetexplorer.ie6.browser)
  • Solved: FreeBSD as print server w/CUPS + samba + apsfilter
    ... CUPS and Samba so that local (connected to server) printers print ... as network printer amongst Windows 2k/XP clients. ... samba over Win2k network" contained what I had accomplished, ...
    (freebsd-questions)