Re: Group Policies

This is not looking llike a DNS problem. The following are common reasons
why GPO settings may fail to apply to a user or computer (10-point check):

1) Machine or user must be a domain member and authenticate with the domain
2) DNS client configuration problem. Is the client's preferred DNS server
setting pointing to a DNS server that handles the zone for AD domain
3) User or machine is not in the container to which the GPO is linked. Run
rsop.msc or gpresult.exe /v on the users workstation to check that the
policy is actually being applied or not.
4) User or machine is under a hierarchy which is blocking the GPO
5) There is group filtering which is preventing the user or machine from
reading the GPO
6) The user is a member of a group which is being filtered from the effect
of Group Policy. For example, the 'Authenticated Users' has "Deny" selected
for 'Appy Group Policy'.
7) If the machine is running a host-based firewall and blocking all ICMP
traffic then group policies will not apply. (Clients test the link speed by
sending an IMCP packet of 2048 bytes).
8) Check to see if the user is a member of too many groups. At the very
least, configure the client firewall to allow inbound ICMP traffic from the
domain controllers.

Quoted from:
Kerberos authentication may not work if user is a member of many groups:
http://support.microsoft.com/default.aspx?scid=kb;en-us;280830

If a user is a member of many groups either directly or because of group
nesting, Kerberos authentication may not work. The Group Policy object (GPO)
may not be applied to the user and the user may not be validated to use
network resources.

9) Are there any errors in the event log concerning seccli or userenv? If
so examine these errors closely.
10)Review the error messages in the %windir%\debug\usermode\userenv.log
file?

--
Todd J Heron, MCSE
Windows Server 2003/2000/NT; CCA
----------------------------------------------------------------------------
This posting is provided "as is" with no warranties and confers no rights

.

Relevant Pages

  • Re: applying group policy
    ... I cannot get the settings for group policy to ... Machine or user must be a domain member and authenticate with the domain ... User or machine is not in the container to which the GPO is linked. ... Kerberos authentication may not work if user is a member of many groups: ...
    (microsoft.public.windows.server.active_directory)
  • Re: Performance monitoring tool for GPO?
    ... Spot GPO differences and inconsistencies with the powerful GPO Compare ... You'd basically start with userenv logging and then see ... that measures the application-time in Group Policy. ... Is DNS still correct? ...
    (microsoft.public.windows.group_policy)
  • Re: Domain Users into Local Admins
    ... checked the DNS is correct and made sure both ... > 3) User or machine is not in the container to which the GPO is linked. ... > 6) The user is a member of a group which is being filtered from the effect ... Kerberos authentication may not work. ...
    (microsoft.public.windows.server.security)
  • Re: Does user have to be a member of domain admins? Surely not!
    ... The userdoes not have to be a member of the domain/local administrators ... What I would do is run the Group Policy Management snap-in and review the ... The delegation is who should modify/delete the gpo.) ... gpo will only apply if the test user is a member of the Domain Admins ...
    (microsoft.public.windows.server.sbs)
  • Re: Domain Users into Local Admins
    ... the client itself to see if any pertinent errors are reported that may help ... > I've just rebooted 4 times, checked the DNS is correct and made sure both ... >> 1) Machine or user must be a domain member and authenticate with the ... >> 3) User or machine is not in the container to which the GPO is linked. ...
    (microsoft.public.windows.server.security)
Loading