Re: Local GPO refreshes outside of refresh interval

Dmitry,
Where is this checkbox? I looked through my GPO's Windows Settings section
and couldn't find any such checkbox. Thanks.

-Parhez



"Dmitry Korolyov [MVP]" wrote:

> Some policies, including IE policies, have a checkbox that defines if this
> particulary setting should be applied only if it was changed in GPO, or if
> it should apply EVEN if the value defined in GPO did not change since the
> last update. This might be your issue.
>
> --
> Dmitry Korolyov [d__k@xxxxxxxxxxxxxxxxxxxxxx]
> MVP: Windows Server - Directory Services
>
>
> "Parhez Sattar" <ParhezSattar@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
> news:72AE195C-FF15-4BFF-A70E-19F1203B8201@xxxxxxxxxxxxxxxx
> > SITUATION:
> > We are experiencing an unique (may be not?) situation where local group
> > policies are getting reapplied only after what seems to be certain changes
> > on
> > the AD GPO. In this case, we are talking about one particular policy:
> > User Configuration\Windows Settings\Internet Explorer Maintenance\URL\Home
> > Page URL.
> > On a few dozen machines that we rolled out using an OS (XP SP1) image, we
> > had implemented this particular policy via the Local Policy, setting the
> > users' hompage to be http://intranet. Subsequently, we decided to not
> > force
> > a homepage on users and therefore, we never set this policy on the AD GPO.
> > Since then we have edited the AD GPO several times, never any settings
> > within
> > the Internet Explorer Maintenance section, however. It appears that the
> > only
> > time (this time) we edited the AD GPO in the IE Maintenance section, it
> > caused the local policy for that section on all machines to be read and
> > loaded again, causing the users to have http://intranet as their homepage
> > which was still set via local Group Policy. Un until this time, the
> > machines have be restarted dozens of times, users logged off and on
> > hundreds
> > of times, and their customized homepages stayed on the machines in
> > question.
> >
> > Even though we knew that group policies are refreshed every 90 minutes on
> > the workstations, the 60 or so workstation that got the homepage set via
> > local group policy never complained as users could change the
> > http://intranet
> > to whatever and the change stuck. Therefore, we figured that particular
> > policy must just set the initial page if set locally and allow changing to
> > something else, and only enforces the homepage if set via AD GPO.
> >
> > TROUBLESHOOTING:
> > I checked the refresh interval settings in the AD GPO. I checked the
> > local
> > settings for group policy processing. We even changed the homepage for
> > some
> > users and set policies in other sections of the AD GPO and did a GPUPDATE
> > /FORCE (and let others just auto refresh at 90 mins) and the problem did
> > NOT
> > reoccur. So, it doesn't seem like the local policy at every 90 minutes
> > setting the homepage to be http://intranet.
> >
> > QUESTION:
> > What causes local group policies to be "reapplied"? Does GPO "refresh"
> > literally mean that all "set" policies are reapplied every 90 minutes on
> > the
> > workstations, whether those policies are "set" locally, at different
> > levels
> > of the AD (site, domain, OU, etc.)? If so, when we change other (non IE)
> > polcies on the AD GPO, why didn't those trigger the local group policies
> > to
> > be reapplied, therefore, why didn't the homepage on those machines get set
> > to
> > http://intranet? If policy1 (i.e. Homepage) in section1 (i.e. Internet
> > Explorer Maintenance) of the AD GPO changes, will that force the local
> > GPO's
> > all policies of section1 to reapply?
> >
> > I know this is a long message and that your time is precious. I
> > appreciate
> > you taking the time. Thanks.
>
>
>
.

Relevant Pages

  • Re: Assigning File and Folder Permissions Via Group Policy
    ... Putting all of our NTFS tweaks in one GPO is attractive to me because we ... rights" policy, and then if we need to break them out later we'll just cross ... my organization has not made a lot of use of group policies. ... A few policies with a lot of settings in each policy may not be the best ...
    (microsoft.public.windows.group_policy)
  • Re: GPO Update Problem (SYSVOL access via UNC)
    ... Server Security and Auditing Policy ... This list only includes links in the domain of the GPO. ... The settings in this GPO can only apply to the following groups, users, ...
    (microsoft.public.win2000.group_policy)
  • Re: GPO Update Problem (SYSVOL access via UNC)
    ... > Server Security and Auditing Policy ... > This list only includes links in the domain of the GPO. ... > The settings in this GPO can only apply to the following groups, users, ...
    (microsoft.public.win2000.group_policy)
  • Re: GPO not picking up computer settings
    ... to the domain container with the password/account settings you want. ... for password/account settings and from what GPO. ... buying any of the highly rated AD or Group Policy books you see at Amazon or ... I have changed all the passwords back to what they were so users are now ...
    (microsoft.public.windows.server.security)
  • Re: DC GPO - password policy not enforced
    ... Which GPO? ... the Domain GPO is where the password policy is enforced. ... > The password policies settings are still in the GPO file. ...
    (microsoft.public.win2000.group_policy)