Problems with GPO

[lilcam]

I'm just about giving up on this GPO stuff. I initially created a GPO by doing the following.

Through AD's User/Computer I right click on the domain name (sacred-heart.org) at the top. Went to the 'Group Policy' tab and created a new GPO named 'Students.' I proceeded to make the necessary changes and all is well. Well, we added some new workstations in our computer lab and the GPO doesnt affect these computers. Well, I shouldnt say that. Changes made to the 'User Configuration' part is fine, but any new changes to the 'User Configuration' and 'Computer Configuration' aren't applied. Things were running smoothly days after we had Win2k up and running. Also, any new user that I add into AD doesnt have GPO applied to them. I copied an existing user's profile for this new user, but it still didnt work.

What am I doing wrong? There are no error messages in the Event log and yes DNS is running fine! Should I create an OU and move the students there? Also, when applying the filters, I gave the group called 'Students' READ and APPLY options. No one else has the apply box checked. If i go ahead and create an OU and move the student accounts there, would I have to play around with the Filtering? Or will the GPO affect those in the OU?

I am tempted to rebuild AD only becuz we have had problems with this server before and we are thinking about replacing the drives. Someone please help!

 

[rezinz28]

What are the clients? PCs, thin clients, W2K, W98, W95.
You might want to start with creating an OU for your workstations. Let us knwo some more details please.
Steve

 

[tlcscousin]

Remember also that group policies set on computers are not taken into effect until 1)replication has occurred. 2) the clients to be affected have been rebooted.
policies against users is 1) after replication 2) on the next logon.
So if you set a policy on a user he or she will have to logoff if currently in a network session and logon.
The best scenario for a group policy is to create an OU place the users/computers to be effected in the ou and then create the GPO and set any settings wanted.

 

[lilcam]

Rebooted, logged off, did the 'secedit...' command and it still doesnt work. I went ahead and created a OU called "Students" and created a couple of test users in there. I then proceeded to move existing PCs on the domain into the 'Student's OU. Rebooted the machine and it still didnt work.

I might add, local policies on the computer seem to be working, but I really need the 'user Configuration' settings from the GPO.

Also, if I just made a GPO for the 'Students' GPO, should I remove GPO from the domain and domain controller? There are existing GPO linked to them, but this was from the initial setup. I didn't want to remove them until I get the new GPO set up correctly. Could that be the problem? But then again, GPOs linked to OUs are applied last.

 

[tlcscousin]

A group policy is applied against any user that has both the read and apply group policy permissions set on them. This also applies for computers. So in the permissions (properties of the OU test by adding the created users to the security of the OU and apply those two permissions on them. either force replication, or wait and then log the users on to a machine. You should see when logging on the dialogue to the effect of applying security settings.

http://support.microsoft.com/default.aspx?scid=kb;en-us;Q315418