Re: Time GPO for Clients

-Ok, this GPO is being applied to computer objects correct?
-Did you tried to reboot the machine?
-Can you post here the template?


--
===================================
I hope that the information above helps you.
Have a Nice day.

Jorge Silva
MCSE, MVP Directory Services
===================================

"Brian Edwards" <BrianEdwards@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:88E9B8F3-3998-4866-92F9-F56F3EB24BAF@xxxxxxxxxxxxxxxx
inline...

"Jorge Silva" wrote:

First let me tel you that in previous post when editing the registry I
was
refering to edit the registry directly and not using GPO, so Nimral is
correct when saying "Policies are applied with system rights".

See inline
I tested the policy I created with a Domain Admin login and the
settings
did
not make it into the registry even though the GPO is properly
configured.

If you run gpupdate /force, does the policy apply?
Any errors in event log?


The policy is getting applied, that's not the problem. It is applying,
but
is not making the registry changes. Rsop indicates that the GPO is making
the change, but a check of the registry disagrees. The settings remain
the
same.


How should I go about tracing the problem? I've verified that no other
GPO's apply these particular settings, so there should be no conflicts.
I've
verified, through gpresult, that the GPO is getting applied to the
computer.

Check for client DNS configuration


All proper.


, and FW blocked connections


Windows Firewall is disabled on all clients/servers.


, also have a
look at EventLog


System log indicates event ID 35 events, saying that the computer is
sync'ing with one of our Domain Controllers. That's on this particular
computer. I'll have to test with another client machine to see if it is
now
behaving as this one is, however, previously most clients were getting
errors
29 & 14.


, there're other tools that might help you to troubleshoot
this, like RSoP.msc, Gpresult and enabling userenv.log

The only thing I can think of is that the Domain Admin account doesn't
have
permissions to make registry changes, although when I manually make a
change
in the Windows Time Service settings, they are accepted and applied.
Is this a custm template or a script that is runing to update these
changes?


Standard GPO template.


If it's a startup script you need to reboot the machine (if applies to
the
machine), if applies to user you must logoff and logon again, but in this
case What I said before applies, meaning that the logged user must have
permissions to do that change.


--
===================================
I hope that the information above helps you.
Have a Nice day.

Jorge Silva
MCSE, MVP Directory Services
===================================


Thanks again, Jorge. It is much appreciated. ;)


I may have found the problem. This particular GPO, in GPMC, under
Delegation, was configured to Deny "Apply Group Policy" permissions to
"Domain Controllers". I wonder if that was affecting clients in that when
authentication occurred, no matter which DC was used to authenticate
against,
that DC was unable to apply the policy to the computer due to that Deny
setting. I removed that Deny setting about an hour ago, and so far I've
been
able to successfully run "w32tm /resync" on every client I've tried.
Previously that command failed on about 50% of the clients.




.

Relevant Pages

  • RE: Windows 2kserver with XP clients - Policies
    ... you mean that you want to control specific XP settings ... Another thing you can do is to import .ADM templates from a Windows ... On a XP machine install a registry monitor tool which monitors the ... if you want to have a gPO setting that disables the ...
    (Security-Basics)
  • Re: Group Policy
    ... Check that the IE version is supported, shown in the settings description. ... Please post the path to the GPO setting. ... This posting is provided "AS IS" with no warranties, ... took affect on the server and not the client. ...
    (microsoft.public.windows.server.setup)
  • Re: Group Policy
    ... Check that the IE version is supported, shown in the settings description. ... Please post the path to the GPO setting. ... Best regards ... took affect on the server and not the client. ...
    (microsoft.public.windows.server.setup)
  • Re: Group Policy
    ... Is XP not compatible with Server 2008 Enterprise? ... Check that the IE version is supported, shown in the settings ... Please post the path to the GPO setting. ... /force on the client machine to update the settings. ...
    (microsoft.public.windows.server.setup)
  • Re: Security
    ... If you set a DACL on the registry keys, you can prevent any user from ... In other words the GPO was still ... >>> I had set Group Policy on the domain controller so that the client ...
    (microsoft.public.win2000.group_policy)
Loading