GPO not being applied. Using Security filtering.

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance

crikan_at_nospam.postalias
Date: 03/01/05 

Date: Tue, 01 Mar 2005 08:37:46 -0800

I'm creating a GPO to control IE's Proxy settings. This is in the user
configuration part of the GPO. I want to use Security Filtering to
control what users are affected by this GPO.

I have a very basic OU structure (Corporate Users, Groups, Computers,
Servers, Terminal Servers). I'm creating the GPO on the W2003 Domain
Controller that has all of the Operations Masters and GPMC w/SP1
installed. The domain and forest are running in "Windows Server 2003
interim" mode.

I've created a GPO called "Proxy Settings", linked it to the "Corporate
Users" OU where all of my user accounts reside. The Link is enabled. I
have removed "Authenticated Users" from the Security Filtering section
of the GPO and added a newly created Global Security Group called
"GP_Proxy_Settings". I have added a small group of users to
"GP_Proxy_Settings" group.

When I run gpresults on the user's computer when they are logged in or
use the "Group Policy Results Wizard" on the Domain controller I get the
same results for two of the users that are in the "GP_Proxy_Settings"
group; "Proxy Settings: Access Denied (Security Filtering)". When I
run the "Group Policy Results Wizard" on a user who is not in the
GP_Proxy_Settings group, they get "{C22AD5C7-F134-4007-9D12-
333B8A6B1CA9} Inaccessible". I have double check the permissions
and GP_Proxy_Settings has READ and APPLY GROUP POLICY for the GPO. One
problem could be that GP_Proxy_Settings does not show up under "The user
is a part of the following security groups:" when gpresult is run, nor
does it show up in the "Group Policy Results Wizard". I have verified
many times that the users are part of the GP_Proxy_Settings Global
group.

I have verified that there are no errors in the Event Viewer and the
users are getting the Default Domain Policy.

Can anyone see where I have gone wrong or have any advice on what I can
do to fix this?

Thanks,
Jason

Relevant Pages

  • Re: Giving admin rights to a subset of computers
    ... so does this point to a gpo problem. ... The user is a member of the following security groups: ... Group Policy was applied from: ... >> member of the 'Administrators' group. ...
    (microsoft.public.win2000.security)
  • Re: Exchange OWA 2003 Trusted Root Certificate
    ... and use those two groups in the GPO Security settings to ... Apply and then what - Assign the GPO to the Domain?. ... > for computers that you want the Group Policy to apply to. ... can I add the machines to the same User Group and then ...
    (microsoft.public.win2000.security)
  • Re: Security Desciptors
    ... The GPO Security Client Side processing engine will take care of ... only appling the security and registry ... settings that are used by the client machine. ... Core Group Policy Technical Reference ...
    (microsoft.public.windows.group_policy)
  • Re: hide/lock security tab in options
    ... >> something like group policy or registry option ... > Security Zones: Use only machine settings ... > Security Zones: Do not allow users to change policies ... still use the Internet Options applet in Control Panel. ...
    (microsoft.public.win2000.group_policy)
  • Re: hide/lock security tab in options
    ... >> something like group policy or registry option ... > Security Zones: Use only machine settings ... > Security Zones: Do not allow users to change policies ... still use the Internet Options applet in Control Panel. ...
    (microsoft.public.windows.inetexplorer.ie6_outlookexpress)