Re: Local GPO refreshes outside of refresh interval

Some policies, including IE policies, have a checkbox that defines if this
particulary setting should be applied only if it was changed in GPO, or if
it should apply EVEN if the value defined in GPO did not change since the
last update. This might be your issue.

--
Dmitry Korolyov [d__k@xxxxxxxxxxxxxxxxxxxxxx]
MVP: Windows Server - Directory Services


"Parhez Sattar" <ParhezSattar@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:72AE195C-FF15-4BFF-A70E-19F1203B8201@xxxxxxxxxxxxxxxx
> SITUATION:
> We are experiencing an unique (may be not?) situation where local group
> policies are getting reapplied only after what seems to be certain changes
> on
> the AD GPO. In this case, we are talking about one particular policy:
> User Configuration\Windows Settings\Internet Explorer Maintenance\URL\Home
> Page URL.
> On a few dozen machines that we rolled out using an OS (XP SP1) image, we
> had implemented this particular policy via the Local Policy, setting the
> users' hompage to be http://intranet. Subsequently, we decided to not
> force
> a homepage on users and therefore, we never set this policy on the AD GPO.
> Since then we have edited the AD GPO several times, never any settings
> within
> the Internet Explorer Maintenance section, however. It appears that the
> only
> time (this time) we edited the AD GPO in the IE Maintenance section, it
> caused the local policy for that section on all machines to be read and
> loaded again, causing the users to have http://intranet as their homepage
> which was still set via local Group Policy. Un until this time, the
> machines have be restarted dozens of times, users logged off and on
> hundreds
> of times, and their customized homepages stayed on the machines in
> question.
>
> Even though we knew that group policies are refreshed every 90 minutes on
> the workstations, the 60 or so workstation that got the homepage set via
> local group policy never complained as users could change the
> http://intranet
> to whatever and the change stuck. Therefore, we figured that particular
> policy must just set the initial page if set locally and allow changing to
> something else, and only enforces the homepage if set via AD GPO.
>
> TROUBLESHOOTING:
> I checked the refresh interval settings in the AD GPO. I checked the
> local
> settings for group policy processing. We even changed the homepage for
> some
> users and set policies in other sections of the AD GPO and did a GPUPDATE
> /FORCE (and let others just auto refresh at 90 mins) and the problem did
> NOT
> reoccur. So, it doesn't seem like the local policy at every 90 minutes
> setting the homepage to be http://intranet.
>
> QUESTION:
> What causes local group policies to be "reapplied"? Does GPO "refresh"
> literally mean that all "set" policies are reapplied every 90 minutes on
> the
> workstations, whether those policies are "set" locally, at different
> levels
> of the AD (site, domain, OU, etc.)? If so, when we change other (non IE)
> polcies on the AD GPO, why didn't those trigger the local group policies
> to
> be reapplied, therefore, why didn't the homepage on those machines get set
> to
> http://intranet? If policy1 (i.e. Homepage) in section1 (i.e. Internet
> Explorer Maintenance) of the AD GPO changes, will that force the local
> GPO's
> all policies of section1 to reapply?
>
> I know this is a long message and that your time is precious. I
> appreciate
> you taking the time. Thanks.


.

Relevant Pages

  • Re: Local GPO refreshes outside of refresh interval
    ... are changed via the GPO or local policy. ... > policies are getting reapplied only after what seems to be certain changes ... we are talking about one particular policy: ... > which was still set via local Group Policy. ...
    (microsoft.public.windows.group_policy)
  • Re: "There are 0 filters" using IPSec via GPO
    ... 1)Deleting all IPSec policies in the GPO ... 4)Assigning "request security" policy in Local Security Settings, ...
    (microsoft.public.win2000.security)
  • Re: Windows 2003 Server - Group Policy
    ... Group Policies refresh time is 90-minute intervals by default. ... For Windows 2000 Computers see the follow KB: ... Policy Inheritance can be set to this OU it means no policies from higher ... You can also set No Override to a particular GPO. ...
    (microsoft.public.win2000.active_directory)
  • RE: Group Policy: multiple password policies in the same domain?
    ... > it under access to the GPO. ... The conflict only happens when both policies ... results in having the policy denied. ... > user accounts it affects be able to read it and have "apply ...
    (Focus-Microsoft)
  • Re: Local GPO refreshes outside of refresh interval
    ... Also I still don't understand why settings some other policies within the IE ... Maintenance section of the AD GPO caused the local GPO's related section to ... we are talking about one particular policy: ... >> which was still set via local Group Policy. ...
    (microsoft.public.windows.group_policy)
Quantcast