Re: Group policy not processing properly

Tech-Archive recommends: Fix windows errors by optimizing your registry

The GPO shows as applied and no other GPOs have the same settings so there
are no conflicts. I also tried setting the GPO settings you recommended and
still no difference.

Any other thoughts? I am still inclined to believe it is the slow link
(maybe).

Regards,
AT

"Herb Martin" wrote:

"AT" <AT@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:A8AE47DD-E0CB-44C4-99C5-B4DBCDA66426@xxxxxxxxxxxxxxxx
1. All the sites and subnets are configured properly
2. Event viewer logs always say group policy has applied successfully
3. I ran the gpresult and it says my policy has applied. However the
settings do not appear (Internet Explorer proxy settings)


Then the GPO in general is being processed properly -- you have
issues with specific settings (contained in that policy.)

Try Florian's suggestion and consider these other ideas if they apply:

1) Is it overriden by a later policy?
2) Try looking at the DETAIL from GRResult and determine if
the policy item is really present and not present (later) in
another policy
3) You applied the GPO itself to an OU (container) which contains
the USERS (proxy is a User area setting) and that the GPResult
shows it assigned to the user (if it were assigned to the
computer
only, the user area would have no effect.)


--
Herb Martin, MCSE, MVP
Accelerated MCSE
http://www.LearnQuick.Com
[phone number on web site]

"Herb Martin" wrote:

"AT" <AT@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:E5DDAB48-BA43-4C84-80D6-24193A23A675@xxxxxxxxxxxxxxxx
Hi all,

I have a very large Windows 2003 /XP network spread accross the
country. I
have several domain controllers placed around the country however most
of
the
remote locations travel accross the links for authentication and other
domain
requests.

Are you Sites properly configured in Sites and Services
so that (true) Sites with DCs are defined by the IP subnets
and (mere) locations are included in the nearest Site so as
to optimize the authentication and such?

The problem I am having is with a group policy that does not apply to
some
of these remote sites (works for about 80% of the sites but not the
rest
of
20%).

Some of Group Policy is depending on not finding a "Slow WAN link"
but most of it should occur over a slow WAN AS LONG AS a DC
is found and authentication occurs.

Does Group Policy ever fail to process yet authentication actually
occur?

I looked into this a lot (replication, DNS resolution, network
infrastructure, group policy setup, permissions, etc) and the only
thing I
can think of would be that the group policy does not apply because of a
slow
link.

This can happen but should NOT be the case for Security and
Registry (Admin templates) entries.

When it does happen, check the "Logon server" using the simple
"Set Logon" command or by using a more capable tool such as
NLTest (very difficult to use however.)

However I am not 100% sure of this. The only error I get is
"PolicyChangedThread: UpdateUser failed with 1008" in the userenv.log.
In
the
event log for the computer it says the group policy has applied
correctly
however when I check out in RSOP nothing shows up.

What about just running GPResult.exe from the command line
of the affected machine?

Any suggestions would be greatly appreciated.



--
Herb Martin, MCSE, MVP
Accelerated MCSE
http://www.LearnQuick.Com
[phone number on web site]


Cheers,
AT






.

Relevant Pages

  • Re: policy for only two computers
    ... a setting in a Domain-linked GPO then the setting in the Domain-linked GPO ... what happens if there are conflicting settings at the same level? ... go to the Group Policy tab and click on the New... ... the Computer Configuration half and the User Configuration ...
    (microsoft.public.win2000.group_policy)
  • Re: iNTERACTIVE LOGON welcome screen - make it go away
    ... I created a custom ADM file for these two settings ... and imported it into the GPO under the Computer Administritative templates. ... really great expertise in Group Policy often reply to posts including ... doing a gpupdate on that domain controller which ideally would be the ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Getting desperate: GPO applying incorrectly, PLEASE HELP ME!!
    ... User and Computer settings a single GPO,. ... OU with the Terminal Server computer accounts, ... See in particular the section called "Group Policy Loopback ...
    (microsoft.public.windows.group_policy)
  • Re: Getting desperate: GPO applying incorrectly, PLEASE HELP ME!!
    ... GPO security settings from the defauts. ... Restart the workstation computer and the Terminal server, ... I've chosen these settings only because the affect is easy to observe. ... add check mark in the Deny column for Apply Group Policy ...
    (microsoft.public.windows.group_policy)
  • Do Not Execute Group Policy for Admins Group
    ... so that the group policy will only apply to a certain group of users ... domain admins that logon to a computer in that OU). ... In this case the GPO would not ... it's intent is to change the user settings ...
    (microsoft.public.win2000.group_policy)