Group Policy Not Apply to Computers/Users

[BBousman]

I'm fairly new with Server 2003 and Active Directory and I can't seem to figure this one out. I've got desktop pc running Server 2003 connected to a hub along with 3 laptops connected on the same hub to act as my client computers. Whenever I change the Default Domain Policy or the Test Policy I have created under my Org Unit. called Information Systems, it doesn't apply those changes after I log off and back on. Is there something that I'm not doing right? In the org unit I have 6 users set up. Any help would be greatly appreciated!

 

[ncotton]

1) Never change the default domain password, other than to edit passwords....THIS IS JUST A RULE
2) You need to make sure that you have linked the test Group Policy Object to the OU. Drag and drop the object from the folder named Group Policy Objects to the OU you want to use.
3)You need to have moved the users and computers from the AD Users and Computers Users Container and Computer Container into the Informations Systems OU.
4)Use this Active Directory OU Structure.
Domain
InformationSystems
InfoSys_Computers
InfoSys_Users

move the computers from the computers container to the InfoSys_Computers OU, and the same for the users into InfoSys_Users.
Then link your Group Policy to InformationSystemsOU.

5)Computers (physical machines) will only process COMPUTER CONFIGURATION settings from the GPO, likewise, User accounts will only proccess USER CONFIGURATION settings from the GPO. If you set 3 computer settings say A, B, C and 3 user settings , X, Y and Z in the one GPO, and you then apply this to InfoSys_Comuters, only A, B and C will be applied, and you will see no evidence of X, Y or Z.
If you take that GPO and apply it at the OU that parents both User and Computers then all settings will be applied

Hope this Helps.

Neil J Cotton
njc Information Systems
Systems Consultant

 

[BBousman]

Right now I have it set up like this:
Domain
InfoSys OU
Info Sys. Users and Computers in the OU

So are you saying I should create 2 Org Units inside the InfoSys OU, one for computers and one for users and then create an GPO for each of the new OU's?

The Test IS Policy is under the group policy for the InfoSys OU so I think that should be fine.

 

[ncotton]

you dont need to create seperate ous for users and computes, its just the "way" for management reasons, no need in test conditions unless you are testing for real life deployment scenarios. But you might aswell for just practice.

Make sure you have actually put the comps and users accounts in the OUs, cause without default, you can only apply policy at domain level as the Users container and Computers container can not have policy applied directory to them as they are only containers and GPOs can only be applied to domains, sites and OUs.

What changes have you made. Make sure there aren't conflicting settings in other policies. (check the presidence list for that organisational unit. The higher up (lower number) means it will overwrite any conflicting settings from higher numbered GPOs.

Policy : Priority : Settings
SetRed : 1 : Set Desktop to Red and Menus to Green
SetBlue: 2 : Set Desktop to Blue and Buttons to Round

will give you
Desktop Red, Menus Green and Buttons Round

if that makes sense.

Hope this Helps.

Neil J Cotton
njc Information Systems
Systems Consultant

 

[BBousman]

Here's how I have the GPO's set:

Default Domain Policy - Nothing is configured with this

Information Systems OU - Don't have a GPO set for this

InfoSys_Users OU - I enabled "Hide and disable all items on desktop"

InfoSys_Computers OU - I enabled "Change the system time" for one computer that's in the OU but not the other.

Neither setting worked.

 

[BBousman]

One other thing I noticed. In the security settings for each Policy, the "Apply Group Policy" setting is only checked for the "Authenticated Users". Is there something I have to change in order to make it work? I'm currently logged into the server as Administrator so I would figure that'd be part of Authenticated Users.

 

[ncotton]

Are you sure the other machines are actually connected to the domain.
The Authenticated Users are all users that are entered in Active Directory domain.

Run the Group Policy Modeling Wizard, at the left of the GPMC towards the bottom enter a domainname\machine that should be getting the setitng and domainname\user in the containers options, then click next, and skip to end/finish. back int he GPMC main window (on the right), click the settings tab, you can now see all the settings that should be applied when the specified user logs on to the specified machine.

Hope this Helps.

Neil J Cotton
njc Information Systems
Systems Consultant

 

[tfg13]

Are you sure you enabled the "new" GPO's? Right click the GPO and "enable".

 

[BBousman]

Someone in another post helped me out. When I installed the Active Directory on the server, it changed the DNS address that I had originally set which was what was causing me the headache. Once I set the DNS of the server to the server's IP Address, it worked fine. Thanks anyways guys.