Re: Default Domain Controllers Policy ISSUE!!!



In article <774B2590-C99C-4677-AF83-E546F8DA3EC6@xxxxxxxxxxxxx>,
Kevin@xxxxxxxxxxxxxxxxxxxxxxxxx says...

Hi Everyone! My SBS 2003 is having this really odd issue with the one of the
GPO's for the Default Domain Controller Security Settings and need help fast.

The "Local Policies/User Rights Assignment" > "Access this computer from the
network" the setting should have a list of users but it does not. I add the
list of default users that should be allowed and everything works fine, but
after 5 or less minutes the system security removes them again.

I've spent days looking for answers to this problem without finding a reason
this is happening on the server. I do see in my event logs that they server
is removing all the users but dont know why. Can anyone help?

Here is a screen capture on what is happening.
http://www.digitaldose.com/photos/gpo/

Based on the screen shots ... are you modifying the local policy using
secpol.msc? If so, it's being overridden by the SBS Default Domain
Controllers Policy GPO. (GPOs are reapplied every 5 minutes on Domain
Controllers and every 90 minutes on other computers in the domain.)

If you need to change the setting, you will need to change the GPO using
the Group Policy Editor.

Another possibility is that another GPO (such as Default Domain Policy)
is overriding the Default Domain Controllers Policy.

You can use the Group Policy Results Wizard in Group Policy Management
to see what is causing particular settings.

-- Owen Williams (SBS MVP)
.



Relevant Pages

  • Re: GPO Update Problem (SYSVOL access via UNC)
    ... Server Security and Auditing Policy ... This list only includes links in the domain of the GPO. ... The settings in this GPO can only apply to the following groups, users, ...
    (microsoft.public.win2000.group_policy)
  • Re: GPO Update Problem (SYSVOL access via UNC)
    ... > Server Security and Auditing Policy ... > This list only includes links in the domain of the GPO. ... > The settings in this GPO can only apply to the following groups, users, ...
    (microsoft.public.win2000.group_policy)
  • Re: GPO not picking up computer settings
    ... to the domain container with the password/account settings you want. ... for password/account settings and from what GPO. ... buying any of the highly rated AD or Group Policy books you see at Amazon or ... I have changed all the passwords back to what they were so users are now ...
    (microsoft.public.windows.server.security)
  • Re: GPO - Access denied after changing a GP setting
    ... You are about to restore Default Domain policy and Default domain Controller po ... This may render some server applications to fail. ... Unable to open the GPO due to access denied. ... You are about to restore Default Domain controller policy for the following domain ...
    (microsoft.public.windows.server.security)
  • Re: Local GPO refreshes outside of refresh interval
    ... I looked through my GPO's Windows Settings section ... > Some policies, including IE policies, have a checkbox that defines if this ... > it should apply EVEN if the value defined in GPO did not change since the ... we are talking about one particular policy: ...
    (microsoft.public.windows.group_policy)