Re: Not Applied GPO

From: Roger Abell (mvpNOSpam_at_asu.edu)
Date: 11/24/04 

Date: Wed, 24 Nov 2004 00:39:57 -0700

If the Default Domain Policy is set to be enforced (no override
in Windows 2000 speak) then blocking GPO inheritance at the
OU will not stop the Default Domain Policy from having effect
in that OU. 

-- 
Roger Abell
Microsoft MVP (Windows  Security)
MCSE (W2k3,W2k,Nt4)  MCDBA
"Jimmy" <jwhk001@hotmail.com> wrote in message
news:OPaU9ad0EHA.2016@TK2MSFTNGP15.phx.gbl...
> Hi, Roger
>
> I made new OU and block inherited. I used the Group Policy Modeling to get
> the report which is indicated the 10 workstation are applied with new OU.
>
> However, I went to those workstation to use gpresult command to get the
> report which is applied with Default Domain Policy. After re-boot the
> workstation, the result is negative.
>
> Furthemore, I go back the Server (W2K3 Standard) use the Group Policy
Result
> to select the workstation with user to get the report which is applied
with
> Default Domain Policy.
>
> Now I do not have any idea to find out where is mistaken the setup.
>
> Can you give me some information for this ??
>
>
> Thanks
> Jimmy
>
> "Roger Abell" <mvpNOSpam@asu.edu> wrote in message
> news:#EoqDbW0EHA.3832@TK2MSFTNGP10.phx.gbl...
> > Jimmy,
> >
> > If you create a new GPO and link it to an OU, leaving all other
> > settings at their defaults, then any computer settings you define
> > within the new GPO will apply to computers that are in the OU,
> > and any user settings to user objects that are in the OU.
> > If you alter the defaults, such as which parts (if any) of the GPO
> > is enabled, whether the link to the OU is enabled, or alter the
> > security ACL of the GPO, then you should do so knowing what
> > these do.  The defaults for these are "ready to go" for most cases.
> >
> > --
> > Roger Abell
> > Microsoft MVP (Windows  Security)
> > MCSE (W2k3,W2k,Nt4)  MCDBA
> > "Jimmy" <jwhk001@hotmail.com> wrote in message
> > news:%23n6GLJR0EHA.3156@TK2MSFTNGP10.phx.gbl...
> > > Hi,
> > >
> > > Under our my domain, I created one OU with 10 clients - XP
Professional
> > SP1
> > > and then created one GPO for them using.
> > >
> > > I used Group Policy Result and Group Policy Model Result, the two
> reports
> > > are indicated ten workstation whose is applied by Default Domain Group
> > > Policy not for OU's GPO.
> > >
> > > Furthermore, I checked with ten workstation and 10 Users's permission
> for
> > > OU's GPO (read only for this container). In the workstation, I used
> > gpresult
> > > command to check, the result is using the Default Domain Group Policy.
> > >
> > > I think that I may be missing something or mistake in the creation of
> GPO.
> > >
> > > Any suggestion is appreciated.
> > >
> > > Thanks
> > > Jimmy
> > >
> > >
> > >
> >
> >
>
>

Relevant Pages

  • Re: Set GPO for specific user group
    ... Click on the domain name in Group Policy Management, select the GPO and then click the arrow to the left to move it to the top of the list ... Filtering: Denied ...
    (microsoft.public.windows.server.sbs)
  • Re: GPO Question
    ... Group Policy Processing ... As described earlier in this paper, Group Policy is processed in the ... Local Group Policy Object, ... Any domain-based GPO may be enforced by using the Enforce ...
    (microsoft.public.win2000.group_policy)
  • RE: Companyweb and guests - advice?
    ... You can find the Default Domain policy under the following node: ... Open server management console, locate Advanced Management -> Group Policy ...
    (microsoft.public.windows.server.sbs)
  • Re: GROUP POLICY
    ... What exactly do you mean with "the policy file only appear in the primary DC"? ... domain policy are applied, that's by design. ... GPO: Default Domain Policy ... Computer Setting: 3 ...
    (microsoft.public.windows.server.active_directory)
  • Re: Group Policy Downloading unchanged GPOs
    ... Speed Group Policy Troubleshooting with the NEW GPHealth Reporter tool at http://www.sdmsoftware.com/products.php ... On analysis we understand that if a CSE has multiple GPO's then even if one of the GPO changes, all the GPO's belonging to that CSE gets read. ... words, they are not held in some separate place on the client), then yes, all settings from all 3 GPOs would be read by the client if just one GPO changes. ...
    (microsoft.public.win2000.group_policy)