Re: Which Settings MUST be assigned to a User?

Hi Bruce,

Thanks for you hepl, but I'm afraid you have a small misunderstanding when
it comes to GPOs. Computer configuration and user configuration are not
specifically applied only to user accounts or computer accounts. They modify
certain parts of the registry. Computer configuration modifies the
HKEY_LOCAL_MASHINE values and user configuration modiefies the
HKEY_CURRENT_USER values. Both can be applied either to user or computer
accounts or both. This makes using GPOs so flexible.

Thanks to a german MVP I've found a solution for my problem. I'll create my
own file by exporting a GPO in which all settings are activated and then
filtering through the descriptions of the policies.

Cheers,

Gerrit

"Bruce Sanderson" wrote:

Not sure if I understand your question properly, so if this is not helpful,
please just ignore it.

Group Policy Management Editor, the settings in the User Configuration part
(lower half) get applied to user accounts.

Those in the Computer Configuration part (upper half) get applied to
computer accounts.

The only exception is that if the "User Group Policy loopback processing
mode" setting is enabled, the settings in the User Configuration part get
applied to user accounts when the user logs on at a computer to which the
GPO, with User Configuration settings in it, is applied.

I'm not familiar with RIS (I assume you mean Remote Installation Services),
but I can't find any GPO settings relating to RIS. If you describe where
these settings are to be found it would be useful.

--
Bruce Sanderson
http://members.shaw.ca/bsanders

It is perfectly useless to know the right answer to the wrong question.



"Gerrit Deike" <GerritDeike@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:95F6DF52-13A4-4056-B415-31E515B424C7@xxxxxxxxxxxxxxxx
Hello Meinolf,

though I agree as far as the administrative chaos goes, I have no choice
in
this matter as that is how the customer is setup. (To make things worse
the
accounts domain is being administerd by T-Systems and not by the customer
himself...)

That is why I want to know which settings only make sense when applied to
user accounts.

Btw. the RIS settings MUST be applied to the user account if your planning
on using different settings on a per user basis, which is the typical
sitiuation. Otherwise you have to apply the settings to the RIS-server,
because that is the computer on which the user is loging on to!

Cheers,

Gerrit Deike
MCT, MCITP: Exchange, MCTS: Exchange, MCSE: Messaging, MCSA: Messaging,
Small Business Specialist
"Meinolf Weber [MVP-DS]" wrote:

Hello Gerrit,

If the computer is in the resource forest RIS has to be setup there,
nothing
to do with the user during RIS installation. RIS does not belong to
users.

GPO's for the user you have to configure in the forest where the user
belongs
to. Policies depends on your requirements.

I can not really understand why you split users and computer with a
trust.
You have additional work, because computer policies has to be configured
in the domain where the users are and the user policies in the other one.

IMHO you create yourself an administrative chaos.

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and
confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


Hello Meinolf,

the two forrests are connected via forrest-trust. The user accounts
are in the account forrest but the computer accounts are in the
resource forrest.

What I need is a list of all GPO-settings that must be assigned to a
user account so that they will work.

The RIS-settings are an example. They will not work when assigned to a
computer account because there is no OS on the client and (usually) we
want to use these settings to differ between users. Are there any more
such settings that only make sense or can only be applied to user
accounts?

Cheers,

Gerrit

"Meinolf Weber [MVP-DS]" wrote:

Hello Gerrit,

Please dsecribe more detailed the different forests, also how are
they connected, with trust? A user account belongs to one domain not
to different forests.

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and
confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
Hi!

Does anybody know which settings must be applied to a user-account
so that they will work? (f. i. RIS-settings)

I'm in a project where the customer has a account-forrest and a
ressource-forrest and I want to make sure that I don't miss any of
the settings!

Thanks!

Gerrit






.

Relevant Pages

  • Re: user settings not applied to computers in ou?
    ... The user configuration portion of a GPO only applies to users who are in the ... OU heirarchy to which the GPO is linked. ... This is it's SOM or Scope ... The computer configuration settings from this list are applied to the ...
    (microsoft.public.win2000.group_policy)
  • Re: Proxy Settings
    ... A GPO is logically made up of two sections - Computer Configuration and User ... Settings under User Configuration affect user accounts the ...
    (microsoft.public.win2000.active_directory)
  • Re: Using GPO to implement Password Policy
    ... I created a new Group Policy Object, Company Password Policy, ... this GPO to a test OU, ... note that the user account settings itself are set to "Password never ... All of my domain accounts are set with these settings for their ...
    (microsoft.public.windows.server.active_directory)
  • Re: cant override screen saver policy
    ... > Yes, I figured out that using loopback processing was the answer (Ok, I ... >> Settings in the User Configuration part of a GPO always apply to User ... >> Accounts, not Computer Accounts, so any User Configuration settings you want ...
    (microsoft.public.win2000.group_policy)
  • Re: Create session two apps no shell (start menu...)
    ... MCSE, CCEA, Microsoft MVP - Terminal Server ... User Configuration - Windows Settings - Folder Redirection ... Then link this GPO to the OU which contains the Terminal ...
    (microsoft.public.windows.terminal_services)