group policy problems 2

[frank049]

I am having problems with win2000 server group policies. I have two groups one locked down and the other group is not heavily locked down for managers.

When I move a user from the lock down list to the managers group it takes the managers group policy. When I then move that person back to the locked down group it still keeps the managers group profile?

 

[welshguy]

Not sure what you mean here.
Do you mean you have two group policies which are assigned via membership of two groups?

If so then the first thing to check is the permissions on the policies.

Make sure that the each policy has the read and apply permission for it's respective group. Also check that you have removed the permissions for authenticated users on each policy as otherwise they will be applied irrespective of groups right down the tree.

THe policies settings will overwrite (unless no override is set) in the order they are applied.

Which is LSDOU
Local, Site, Domain, OU - therefore an OU policy will overwrite a domain policy setting (excepting no override)

You should also check using gpresult which policies are being applied - to get a clearer picture of what's going on.

Hope I'm not on completely the wrong track here.

Cheers

 

[iwasinnamuknow]

i see you are someone who is successfully using group policies. Why don't mine work? the policy is applied for the whole domain but is not applies to clients. the same goes for policies created with poledit.exe (save as ntconfig.pol in the NETLOGON dir).

 

[welshguy]

Would need a few more details but 99% of the time
- group policies not being applied points to a DNS problem.
You must have DNS set up properly and your clients pointing to this server.

Check this out and post details if it's still not working


I have written a GPO troubleshooting guide which I will get round to posting one day !!

Cheers

 

[frank049]

With regard to my original problem this was resolved by going into the DNS forward look-up and going onto the properties of the site under general their is an opiton called
"Allow dynamic updates?"

This has a drop down menu selected "yes" problem resolved.

Now I just need to reset user profiles.