Group Policy help W2K3 Server - Tilted Forum Project Discussion Community

chewybaca96 · 02-25-2005, 11:31 AM

I run a small network of about 30 pc's. I'm currently working on setting up a group policy to affect a specific group of users. Users are setup in active directory (AD) into seperate organizational units (OU).
When i create a new group policy object (GPO) and apply it to an OU, it will not take effect. Only GPO's at the domain level are applied to users, and only if it is applied to authenticated users only. if i remove authenticated users and try to apply it to any specific users or any specific security group, it will not take effect. Any help on this? why can i only set up a GPO that will affect all users on the domain at the domain level? Why cant i set up a GPO that affects either a security group or an OU?.
thanks in advance.

rubicon · 02-26-2005, 06:58 PM

A few things to look at...

GPO settings are defined as Computer or User centric. GPOs with mixed policies (Computer and User) will only apply to the like objects in the OU. Thus, Computer policies won't apply to John Smith in the Marketing OU. You must apply a mixed GPO against the OU(s) which are home to the User and Computer object(s).

You may also want to look at the ACL on your new GPO. Some times Windows may lose an ACL you need for the policies to apply. Not sure why but I've seen it happen.

Windows Server 2003 has some good tools to do all of this: AD Users & Computers is a start then the Group Policy Admin tool (via MMC) gives you the skinny on settings, ACLs, etc. Don't forget to use the GPRESULT app on the client computer to view which policies are being applied and which are not.

chewybaca96 · 03-01-2005, 03:12 PM

thanks rubicon. took some playing and tweaking but i got it to finally work properly. now the little bastards cant play games all day. hehe

02-25-2005, 11:31 AM	#1 (permalink)
chewybaca96 We can't stop here! This is bat country! Location: SL,UT	Group Policy help W2K3 Server I run a small network of about 30 pc's. I'm currently working on setting up a group policy to affect a specific group of users. Users are setup in active directory (AD) into seperate organizational units (OU). When i create a new group policy object (GPO) and apply it to an OU, it will not take effect. Only GPO's at the domain level are applied to users, and only if it is applied to authenticated users only. if i remove authenticated users and try to apply it to any specific users or any specific security group, it will not take effect. Any help on this? why can i only set up a GPO that will affect all users on the domain at the domain level? Why cant i set up a GPO that affects either a security group or an OU?. thanks in advance. __________________ Brian: “Ok, all we’ve gotta do is find the American Embassy, and they’ll help us get home” Stewie: “Home? I have no intention of returning to that disgusting hovel with that intolerable woman, that fat slob, and that insufferable dog… Oh, you’re right here aren’t you? Oh well, I stand by it."

02-26-2005, 06:58 PM	#2 (permalink)
rubicon Stop. Think. Question. Location: Redondo Beach, CA	A few things to look at... GPO settings are defined as Computer or User centric. GPOs with mixed policies (Computer and User) will only apply to the like objects in the OU. Thus, Computer policies won't apply to John Smith in the Marketing OU. You must apply a mixed GPO against the OU(s) which are home to the User and Computer object(s). You may also want to look at the ACL on your new GPO. Some times Windows may lose an ACL you need for the policies to apply. Not sure why but I've seen it happen. Windows Server 2003 has some good tools to do all of this: AD Users & Computers is a start then the Group Policy Admin tool (via MMC) gives you the skinny on settings, ACLs, etc. Don't forget to use the GPRESULT app on the client computer to view which policies are being applied and which are not. __________________ How you do anything is how you do everything. Last edited by rubicon; 02-26-2005 at 07:02 PM..

03-01-2005, 03:12 PM	#3 (permalink)
chewybaca96 We can't stop here! This is bat country! Location: SL,UT	thanks rubicon. took some playing and tweaking but i got it to finally work properly. now the little bastards cant play games all day. hehe __________________ Brian: “Ok, all we’ve gotta do is find the American Embassy, and they’ll help us get home” Stewie: “Home? I have no intention of returning to that disgusting hovel with that intolerable woman, that fat slob, and that insufferable dog… Oh, you’re right here aren’t you? Oh well, I stand by it."