AD not forcing Group Policy to Windows XP machines

[Bawaddell]

We are in the process of creating a Windows XP image to rollout to our enviroment. I created a new OU in AD and set a new GP so the computer will have a specific Desktop Backgroup, for some reason AD is not pushing the GP to the XP machine.

Any suggestions?

 

[DTracy]

Check the status of the firewall on the XP workstations, I think it may need to be off for the policy to be received.

That's about all I can think of right now.

det

 

[Bawaddell]

DTracy,

Good thinking, but we did check the firewall and it is turned off.

I took it one step further, I put one of our Windows 2000 Professional machines in the same OU, the GPO never updated to the Win2K machine either. I made sure that the GPO is linked to the Domain OU, with no override set for the GPO on the Windows XP OU.

Just guessing, I think it is an issue with the Link between the GPO and the OU, but I have triple checked my settings, and pulled out all of my hair.

 

[DTracy]

How about service packs on the 2003. If you haven't installed the SP-1, be carefull as it will bring the firewalls up on all your XP workstations whether you want it or not.

 

[DTracy]

Oh, never mind the 2003, I was looking at the wrong server, your'e in the 2000 rather. Sorry.

 

[DTracy]

Are you using McAfee ePO and VirusScan 8.0? There is a setting in there that might effect your policy distribution.

det

 

[Bawaddell]

We are using Virus Scan 8.0, I will look into that.

 

[DTracy]

Ok, if you are only using the VirusScan 8.0, open the console>Access Protection>File, Share and Folder Protection>, Prevent remote creation/modification/deletion of files in the Windows folder and subfolder (.ini) should be unchecked. This is a workaround only. The network policy requires the right to create a .ini file. When it can't, it dies.

Hope this helps.

det

 

[ncotton]

The desktop settings are part of the USER SETTINGS, so you need to apply it to a OU that holds user accounts, not machine accounts. When applying a GPO to an OU of machines, the machines will only evaluate the contents of the COMPUTER SETTINGS, and will ignore any settings set in the USER SETTINGS.

If the OU contains both the relevant users and computer objects, then all the settings in that GPO are applied. If one of these users, logs onto a machine outside of said OU, then the USER SETTINGS will be applied, but machine setings will not.

Hope this Helps.

Neil J Cotton
njc Information Systems
Systems Consultant