Re: IPSEC Policy question

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance

From: Steven L Umbach (n9rou_at_nospam-comcast.net)
Date: 12/18/04 

Date: Fri, 17 Dec 2004 19:11:52 -0600

Make sure you refresh the security policy on the domain controller when done
and then reboot the computers you want to ipsec policy to apply to. I have
difficulty one time getting ipsec policy to apply to domain computers and a
reboot was required to get it to work. Beyond that make sure that the Group
Policy has been applied to the computer. The support tool gpresult can show
what computer Group Policies have applied to a computer and the last time
the policy was applied. It will also show the location of the computer in
the domain so that you can check that it shows as having an account in the
right OU. It is also helpful define another setting or two in the GPO to see
if those settings apply which can help troubleshoot if your problem is with
the ipsec policy or the GPO itself being applied. For Windows 2000 you can
use netdiag as in " netdiag /test:ipsec " to see what ipsec policy, if any,
is being applied to a computer. " netdiag /test:ipsec /debug " will give
much more detailed info about an ipsec policy. For XP Pro, use the mmc
snapin for the two ipsec options to see what ipsec policy has been applied
to it. Group Policy problems can often be caused by dns misconfiguration
[see link below for more info] in the domain or something as simple as
policy not propagating yet. --- Steve

http://support.microsoft.com/default.aspx?scid=kb%3Ben-us%3B291382 -- AD
dns FAQ.

"Brandon McHenry" <BrandonMcHenry@discussions.microsoft.com> wrote in
message news:FB60481F-C53D-4E4B-970B-3F33988D1D4C@microsoft.com...
>
> Well I put the computer object in the correct OU but it still isn't
> working.
> So I started all over and remade everything to make sure it was done
> correctly and it still isn't working. I can get it to work on the local
> policy, just can't get it to work on the GPO. Any ideas?
>
> By the way that link to that article comes up with no article found for
> me.

Relevant Pages

  • Re: GPO & IPSEC question
    ... but not for IPsec policy. ... You can also use GPMC to make a report (and for that matter ... GPMC does not handle the IPsec policy in its reports. ... >>> GPO Comparison ...
    (microsoft.public.windows.server.security)
  • Re: users reaching server from computer not in domain
    ... GPO for Computers should include Respond Only Ipsec policy. ... llawren felt like saying: ...
    (microsoft.public.windows.server.security)
  • Re: IPSec Policies
    ... finished my question post. ... How does IPSec Policies accumulate? ... that the lowest OU's GPO gets the highest precedence. ... IPSec policy is one item in the GPO.. ...
    (microsoft.public.windows.server.active_directory)