Can't find AD setting

[IMdaTEK]

A setting has been configured in AD that restricts certain users from accessing My Docs. I have looked under: user configuration, admin templates, desktop; user, config, admin templates, system, ... What am I overlooking?

 

[lebisol]

certain users from accessing My Docs"

need more info on this concept....
if ur using Group Policy then make sure that those users are in the security group associated. if it is Not affecting all users then it must be their group membership
All the best!

:--------------------------------------------------------------------------:

All around in my home town,
They tryin' to track me down...

 

[IMdaTEK]

they are not members of any security group, just an ou w/ gpo linked. the setting must be in the gpo, but not sure which setting...

 

[nsanto17]

you should have a seperate gpo for each setting... Just for reasons like this..

I would remove the gpo link and start creating individual gpo's for each setting... It takes more time to set it up this way but its much eaiser on the administration end....

 

[lebisol]

nsanto17 gave you a good advice....if u can afford to do it at this time then even better

but if redesign is not an option tweak your policy:
user configuration > admin templates > desktop > Remove my documents icon from desktop
could be a start...

or use folder redirection for my documents then prevent access to redirected location or any 'type of rights' you want to give them...

All the best!

:--------------------------------------------------------------------------:

All around in my home town,
They tryin' to track me down...

 

[IMdaTEK]

When you say EACH setting, how many possible GPOs are you talking about? I see your point, but seems like i'd end up w/ too many

 

[IMdaTEK]

the group policy management console displays approx. 55 entries for user config> windows settings & admin templates w/ multiple entries below each. are you recommending i create about that many gpos?

 

[lebisol]

no no no
1 gpo (or as many as u need) per group....
--------------
eg.
create an Organizational Unit called "Marketing"
then iside of it create a Security Group "GRP_Marketing"

make your users members of this security group (those that u want restricted) and then apply 1 policy (with the setting described above) over Organizational Unit (Marketing)....
------------------


thats too many polices, I am sure u can consolidate them...but thats some major work asu have to check what each policy does. perhaps some of them were created for testing but never applied.
U can "export list" from polices and compare them....again..time is not on your side...this is tedious job.

or
just find that one of those 55 GPOs that applies to your group u can also check to see which policy is applied on user

http://www.microsoft.com/windows2000/techinfo/reskit/tools/existing/gpresult-o.asp

there are many ways to go about doing the same thing....AD design is one of those where u can get many suggestions..

All the best!

:--------------------------------------------------------------------------:

All around in my home town,
They tryin' to track me down...