Trouble with GPO's

I have been asking this question in Windows SBS 2003 newsgroups so far
to no avail, thought maybe someone here could help me.

I have been trying to figure this out. I have Windows Server 2003, and
I cannot get my personalized GPO's to work.

My client PC's are XP Pro, I have added 1 restriction for 1 user, just
to try to make it work. What I did is enforced Prohibit access to control
panel (I figured it would be easy to check). I created a GPO named John
Doe, then I put it last in the list under domainname.local, which happens to
be 7. Upon logging on as John Doe the control panel is still present. I
checked it on a client computer. The users are in the SBSUsers OU, and I
put the GPO link in (MyBusiness/Users).

What I want to do is be able to set restrictions on the users in my
domain.

I went into Group Policy Relusts, and upon generating results on this
Policy, and under Applied GPO's it doesn't even show up, and under Denied
GPO's, it also doesn't show up.

What am I doing wrong?

I can't seem to figure this out and would really appreciate any help you
could give me.

Any help appreciated,
Dave Marden (david@nospam.mardenfamily.com)

MikeF
Tue Feb 03 11:57:10 CST 2004

First, let me ask if that GP Relusts works when you are over 50, and
if it is available as a pill.

Second, I'm not sure what you're doing wrong (aside from 7 GPOs
perhaps being too many; MS suggests fewer GPOs = better life for the
admin) but it sounds like it's being overridden. Generally, the
things to check are - has policy had time to refresh? did you
refresh it manually? did you double check that you clicked OK and did
not inadvertently click cancel somewhere as you were backing out of
the GP editor? is it linked to the right OU? are you sure your
priorities are right, i.e., is another GPO being applied later, or is
there one closer to the object? Have you imported a template that
would cancel its settings? Sometimes settings you can't seem to find
the source of come from a template you forgot you applied.....

good luck!

Mike


"Dave Marden" <anonymous@microsoft.com> wrote in message
news:OzW%23Lkm6DHA.1948@TK2MSFTNGP12.phx.gbl...
> I have been asking this question in Windows SBS 2003 newsgroups
so far
> to no avail, thought maybe someone here could help me.
>
> I have been trying to figure this out. I have Windows Server
2003, and
> I cannot get my personalized GPO's to work.
>
> My client PC's are XP Pro, I have added 1 restriction for 1
user, just
> to try to make it work. What I did is enforced Prohibit access to
control
> panel (I figured it would be easy to check). I created a GPO named
John
> Doe, then I put it last in the list under domainname.local, which
happens to
> be 7. Upon logging on as John Doe the control panel is still
present. I
> checked it on a client computer. The users are in the SBSUsers OU,
and I
> put the GPO link in (MyBusiness/Users).
>
> What I want to do is be able to set restrictions on the users in
my
> domain.
>
> I went into Group Policy Relusts, and upon generating results on
this
> Policy, and under Applied GPO's it doesn't even show up, and under
Denied
> GPO's, it also doesn't show up.
>
> What am I doing wrong?
>
> I can't seem to figure this out and would really appreciate any
help you
> could give me.
>
> Any help appreciated,
> Dave Marden
(david@nospam.mardenfamily.com)
>
>

Dave
Tue Feb 03 18:38:28 CST 2004

First, I plan to get rid of some of the default ones, but would like to know
how to get my to function correctly first.

This is what it looks like in my Server Console -> Group Policy Management.


This is what it looks like in my Server Console -> Group Policy Management.

Forest: Mardens.local
Domains
Mardens.local
Default Domain Policy
Small Business Server Client Computer
Small Business Server Domain Password Policy
Small Business Server Folder Redirection
Small Business Server Lockout Policy
Small Business Server Remote Assistance Policy
Domain Controllers
Default Domain Controllers Policy
Small Business Server Auditing Policy
MyBusiness
Users
SBS High Rights
High Rights
SBS Low Rights
Low Rights
Group Policy Objects
Default Domain Controllers Policy
Default Domain Policy
High Rights
Low Rights
Small Business Server Auditing Policy
Small Business Server Client Computer
Small Business Server Domain Password Policy
Small Business Server Folder Redirection
Small Business Server Lockout Policy
Small Business Server Remote Assistance Policy


Under Group Policy Objects -> High Rights
Scope ->
Location - SBS High Rights
Enforced - No
Link Enabled - Yes
Path Mardens.local/MyBusiness/Users/SBS High Rights
Security Filter - Authenticated Users

Details
GPO Status
Enabled

Settings ->
Computer Configuration (Enabled)
No Settings Defined
User Configuration (Enabled)
Admin Temp
Control Panel
Policy
Prohibit access to the Control Panel
Enabled

Delegation ->
Authenticated Users -> Read(From Security Filtering) -> Inherited -> No
Domain Admins -> Edit Settings, delete, modify security -> Inherited -> No
Enterprise Admins -> Edit Settings, delete, modify security ->
Inherited -> No
Enterprise Domain Controllers -> Read -> Inherited -> No
System -> Edit settings, delete, modify security

Temporarily I have it set up in High Rights, but this is actually one of
the things I ultimately plan to put in Low Rights. I would really
appreciate any help with this. Hopefully there is something here obvious to
someone. Please help, any ideas appreciated.

Dave Marden
david@nospam.mardenfamily.com

P.S. The attachment is a Wordpad file just in case this doesn't show
correct formatting on your newsreader.





"MikeF" <wallacestevens54@removethisfirstyahoo.com> wrote in message
news:uFSai8n6DHA.3308@TK2MSFTNGP11.phx.gbl...
> First, let me ask if that GP Relusts works when you are over 50, and
> if it is available as a pill.
>
> Second, I'm not sure what you're doing wrong (aside from 7 GPOs
> perhaps being too many; MS suggests fewer GPOs = better life for the
> admin) but it sounds like it's being overridden. Generally, the
> things to check are - has policy had time to refresh? did you
> refresh it manually? did you double check that you clicked OK and did
> not inadvertently click cancel somewhere as you were backing out of
> the GP editor? is it linked to the right OU? are you sure your
> priorities are right, i.e., is another GPO being applied later, or is
> there one closer to the object? Have you imported a template that
> would cancel its settings? Sometimes settings you can't seem to find
> the source of come from a template you forgot you applied.....
>
> good luck!
>
> Mike
>
>
> "Dave Marden" <anonymous@microsoft.com> wrote in message
> news:OzW%23Lkm6DHA.1948@TK2MSFTNGP12.phx.gbl...
> > I have been asking this question in Windows SBS 2003 newsgroups
> so far
> > to no avail, thought maybe someone here could help me.
> >
> > I have been trying to figure this out. I have Windows Server
> 2003, and
> > I cannot get my personalized GPO's to work.
> >
> > My client PC's are XP Pro, I have added 1 restriction for 1
> user, just
> > to try to make it work. What I did is enforced Prohibit access to
> control
> > panel (I figured it would be easy to check). I created a GPO named
> John
> > Doe, then I put it last in the list under domainname.local, which
> happens to
> > be 7. Upon logging on as John Doe the control panel is still
> present. I
> > checked it on a client computer. The users are in the SBSUsers OU,
> and I
> > put the GPO link in (MyBusiness/Users).
> >
> > What I want to do is be able to set restrictions on the users in
> my
> > domain.
> >
> > I went into Group Policy Relusts, and upon generating results on
> this
> > Policy, and under Applied GPO's it doesn't even show up, and under
> Denied
> > GPO's, it also doesn't show up.
> >
> > What am I doing wrong?
> >
> > I can't seem to figure this out and would really appreciate any
> help you
> > could give me.
> >
> > Any help appreciated,
> > Dave Marden
> (david@nospam.mardenfamily.com)
> >
> >
>
>


begin 666 GPO Problem.rtf
M>UQR=&8Q7&%N<VE<86YS:6-P9S$R-3)<9&5F9C!<9&5F;&%N9S$P,S-[7&9O
M;G1T8FQ[7&8P7&9R;VUA;EQF<')Q,EQF8VAA<G-E=# @5&EM97,@3F5W(%)O
M;6%N.WU[7&8Q7&9S=VES<UQF8VAA<G-E=# @07)I86P[?7T-"GM<8V]L;W)T
M8FP@.UQR960P7&=R965N,%QB;'5E,C4U.WT-"GM<*EQG96YE<F%T;W(@37-F
M=&5D:70@-2XT,2XQ-2XQ-3 S.WU<=FEE=VMI;F0T7'5C,5QP87)D7&8P7&9S
M,C0@5&AI<R!I<R!W:&%T(&ET(&QO;VMS(&QI:V4@:6X@;7D@4V5R=F5R($-O
M;G-O;&4@+3X@1W)O=7 @4&]L:6-Y($UA;F%G96UE;G0N(%QP87(-"EQP87(-
M"D9O<F5S=#H@36%R9&5N<RYL;V-A;%QP87(-"B @1&]M86EN<UQP87(-"B @
M("!-87)D96YS+FQO8V%L7'!A<@T*7'1A8B!$969A=6QT($1O;6%I;B!0;VQI
M8WE<<&%R#0I<=&%B(%-M86QL($)U<VEN97-S(%-E<G9E<B!#;&EE;G0@0V]M
M<'5T97)<<&%R#0I<=&%B(%-M86QL($)U<VEN97-S(%-E<G9E<B!$;VUA:6X@
M4&%S<W=O<F0@4&]L:6-Y7'!A<@T*7'1A8B!3;6%L;"!"=7-I;F5S<R!397)V
M97(@1F]L9&5R(%)E9&ER96-T:6]N7'!A<@T*7'1A8B!3;6%L;"!"=7-I;F5S
M<R!397)V97(@3&]C:V]U="!0;VQI8WE<<&%R#0I<=&%B(%-M86QL($)U<VEN
M97-S(%-E<G9E<B!296UO=&4@07-S:7-T86YC92!0;VQI8WE<<&%R#0I<=&%B
M($1O;6%I;B!#;VYT<F]L;&5R<UQP87(-"EQT86(@("!$969A=6QT($1O;6%I
M;B!#;VYT<F]L;&5R<R!0;VQI8WE<<&%R#0I<=&%B(" @4VUA;&P@0G5S:6YE
M<W,@4V5R=F5R($%U9&ET:6YG(%!O;&EC>5QP87(-"EQT86(@37E"=7-I;F5S
M<UQP87(-"EQT86(@("!5<V5R<UQP87(-"EQT86(@(" @(%-"4R!(:6=H(%)I
M9VAT<UQP87(-"EQT86(@(" @(" @2&EG:"!2:6=H='-<<&%R#0I<=&%B(" @
M("!30E,@3&]W(%)I9VAT<UQP87(-"EQT86(@(" @(" @3&]W(%)I9VAT<UQP
M87(-"EQT86(@1W)O=7 @4&]L:6-Y($]B:F5C='-<<&%R#0I<=&%B(" @1&5F
M875L="!$;VUA:6X@0V]N=')O;&QE<G,@4&]L:6-Y7'!A<@T*7'1A8B @($1E
M9F%U;'0@1&]M86EN(%!O;&EC>5QP87(-"EQT86(@("!(:6=H(%)I9VAT<UQP
M87(-"EQT86(@("!,;W<@4FEG:'1S7'!A<@T*7'1A8B @(%-M86QL($)U<VEN
M97-S(%-E<G9E<B!!=61I=&EN9R!0;VQI8WE<<&%R#0I<=&%B(" @4VUA;&P@
M0G5S:6YE<W,@4V5R=F5R($-L:65N="!#;VUP=71E<EQP87(-"EQT86(@("!3
M;6%L;"!"=7-I;F5S<R!397)V97(@1&]M86EN(%!A<W-W;W)D(%!O;&EC>5QP
M87(-"EQT86(@("!3;6%L;"!"=7-I;F5S<R!397)V97(@1F]L9&5R(%)E9&ER
M96-T:6]N7'!A<@T*7'1A8B @(%-M86QL($)U<VEN97-S(%-E<G9E<B!,;V-K
M;W5T(%!O;&EC>5QP87(-"EQT86(@("!3;6%L;"!"=7-I;F5S<R!397)V97(@
M4F5M;W1E($%S<VES=&%N8V4@4&]L:6-Y7'!A<@T*7'!A<@T*7'!A<@T*56YD
M97(@1W)O=7 @4&]L:6-Y($]B:F5C=',@+3X@2&EG:"!2:6=H='-<<&%R#0I3
M8V]P92 M/EQP87(-"B @3&]C871I;VX@+2!30E,@2&EG:"!2:6=H='-<<&%R
M#0H@($5N9F]R8V5D(%QE;F1A<V@@($YO7'!A<@T*("!,:6YK($5N86)L960@
M7&5N9&%S:" @665S7'!A<@T*("!0871H($UA<F1E;G,N;&]C86PO37E"=7-I
M;F5S<R]5<V5R<R]30E,@2&EG:"!2:6=H='-<<&%R#0H@(%-E8W5R:71Y($9I
M;'1E<B!<96YD87-H("!!=71H96YT:6-A=&5D(%5S97)S7'!A<@T*7'!A<@T*
M1&5T86EL<UQP87(-"B @1U!/(%-T871U<UQP87(-"B @16YA8FQE9%QP87(-
M"EQP87(-"E-E='1I;F=S("T^7'!A<@T*("!#;VUP=71E<B!#;VYF:6=U<F%T
M:6]N("A%;F%B;&5D*5QP87(-"B @("!.;R!3971T:6YG<R!$969I;F5D7'!A
M<@T*("!5<V5R($-O;F9I9W5R871I;VX@*$5N86)L960I7'!A<@T*(" @($%D
M;6EN(%1E;7!<<&%R#0H@(" @("!#;VYT<F]L(%!A;F5L7'!A<@T*(" @(" @
M("!0;VQI8WE<<&%R#0H@(" @(" @(" @4')O:&EB:70@86-C97-S('1O('1H
M92!#;VYT<F]L(%!A;F5L7'!A<@T*(" @(" @(" @(" @16YA8FQE9%QP87(-
M"EQP87(-"D1E;&5G871I;VX@+3Y<<&%R#0H@($%U=&AE;G1I8V%T960@57-E
M<G,@+3X@4F5A9"A&<F]M(%-E8W5R:71Y($9I;'1E<FEN9RD@+3X@26YH97)I
M=&5D("T^($YO7'!A<@T*("!$;VUA:6X@061M:6YS("T^($5D:70@4V5T=&EN
M9W,L(&1E;&5T92P@;6]D:69Y('-E8W5R:71Y("T^($EN:&5R:71E9" M/B!.
M;UQP87(-"B @16YT97)P<FES92!!9&UI;G,@+3X@161I="!3971T:6YG<RP@
M9&5L971E+"!M;V1I9GD@<V5C=7)I='D@+3X@26YH97)I=&5D("T^($YO7'!A
M<@T*("!%;G1E<G!R:7-E($1O;6%I;B!#;VYT<F]L;&5R<R M/B!296%D("T^
M($EN:&5R:71E9" M/B!.;UQP87(-"B @4WES=&5M("T^($5D:70@<V5T=&EN
M9W,L(&1E;&5T92P@;6]D:69Y('-E8W5R:71Y7'!A<@T*7'!A<@T*7'1A8B!4
M96UP;W)A<FEL>2!)(&AA=F4@:70@<V5T('5P(&EN($AI9V@@4FEG:'1S+"!B
M=70@=&AI<R!I<R!A8W1U86QL>2!O;F4@;V8@=&AE('1H:6YG<R!)('5L=&EM
M871E;'D@<&QA;B!T;R!P=70@:6X@3&]W(%)I9VAT<RX@($D@=V]U;&0@<F5A
M;&QY(&%P<')E8VEA=&4@86YY(&AE;' @=VET:"!T:&ES+B @2&]P969U;&QY
M('1H97)E(&ES('-O;65T:&EN9R!H97)E(&]B=FEO=7,@=&\@<V]M96]N92X@
M(%!L96%S92!H96QP+"!A;GD@:61E87,@87!P<F5C:6%T960N7'!A<@T*7'!A
M<@T*1&%V92!-87)D96Y<<&%R#0I[7&9I96QD>UPJ7&9L9&EN<W1[2%E015),
M24Y+(")M86EL=&\Z9&%V:61 ;F]S<&%M+FUA<F1E;F9A;6EL>2YC;VTB('U]
M>UQF;&1R<VQT>UQC9C%<=6P@9&%V:61 ;F]S<&%M+FUA<F1E;F9A;6EL>2YC
M;VU]?7U<8V8P7'5L;F]N95QF,%QF<S(T7'!A<@T*7'!A<@T*4"Y3+B @5&AE
M(&%T=&%C:&UE;G0@:7,@82!W;W)D<&%D(&9I;&4@:G5S="!I;B!C87-E('1H
M:7,@9&]E<VY<<G%U;W1E('0@<VAO=R!C;W)R96-T(&9O<FUA='1I;F<@;VX@
H>6]U<B!N97=S<F5A9&5R+EQP87(-"EQF,5QF<S(P7'!A<@T*?0T*````
`
end

Dave
Wed Feb 04 05:21:33 CST 2004

I ran into this in the Small Business Server Client
Computer GPO. When looking at the GPO, under Computer
Configuration -> Admin Templates -> Extra Registry
Settings ->:

Display names for some settings cannot be found. You
might be able to resolve this issue by updating the .ADM
files used by Group Policy Management.
-> Setting:
->
software\microsoft\windowsnt\currentversion\winlogon\SyncFo
regroundPolicy
-> State:
-> 1

I went looking through Microsofts knowledge base and found
an article. What I am wondering is whether this could be
causing me the problems that I am having? Also how do I
fix it, or should I just do one of the things it mentions?

Here is the article from the knowledge base:

SUMMARY
In Enterprise environments, there may be hundreds of Group
Policy objects that you want to deploy in a domain. Each
Group Policy object is stored in the Sysvol share of each
domain controller. By default, a copy of the
Administrative Templates (.adm) files are copied to each
policy object in the file path:
%systemroot%\sysvol\domainname\Policies\POLICYGUID\Adm

In Windows Server 2003, the size of the Administrative
Templates has grown. As a result, the set of
Administrative Templates has grown to almost 1.75 MB. When
you multiply this size by each Policy that Sysvol
contains, you can see that much space is devoted to these
templates.

Based on these facts, Administrators may want to use two
Group Policy settings that reduce some of the strain that
this Sysvol size growth causes. You must make sure that
you set the settings correctly. If you do not, you may not
be able to manage the Administrative Templates settings on
some Group Policy objects. The two settings are Always use
local ADM files for Group Policy Editor and Turn off
automatic update of ADM files.

To locate these settings, in Group Policy expand Computer
Configuration, expand Administrative Templates, expand
System, and then expand Group Policy. Complete
descriptions of these settings are included in the "More
Information" section of this article.

The following list of scenarios describes how Group Policy
behaves after you modify the settings:
Scenario 1:

Turn off Automatic Update of ADM files is enabled:
Always use local ADM files for Group Policy Editor is
enabled:
Local Administrative Template files (.ADM files) are not
copied to SYSVOL.
Displays the settings in Group Policy by using the
local .adm files in %systemroot%\inf.
Scenario 2:

Turn off Automatic Update of ADM files is enabled:
Always use local ADM files for Group Policy Editor is
disabled:
Local copies of .adm files are not copied to SYSVOL.
Displays the settings based on the .adm files located in
SYSVOL
On this setting, if the SYSVOL copies of the .adm files
are deleted, then you cannot view or edit the
Administrative Templates section of Group Policy. If the
copies of the .adm files in SYSVOL are Windows 2000
versions, new settings are not available in the policy.
Scenario 3:

Turn off Automatic Update of ADM files is disabled:
Always use local ADM files for Group Policy Editor is
enabled:
Local copies of the .adm files are copied to SYSVOL.
Displays the settings based on the .adm files located in
the %Systemroot%\inf folder.
Scenario 4:

Turn off Automatic Update of ADM files is disabled:
Always use local ADM files for Group Policy Editor is
disabled:
Local copies of the .adm files present in the %Systemroot%
\inf folder are not copied to SYSVOL
Copies of the .adm files in SYSVOL determine policy
In this scenario, the automatic method of upgrading policy
templates is disabled, but the client continues to
reference SYSVOL for the .adm files. If you must upgrade a
template, you must do so manually.





I am going nuts here, please help.

Thanks In Advance,
Dave Marden

Dave
Wed Feb 04 09:26:42 CST 2004

I just noticed that the only policy's that seem to be inherited by my
users is the local policies. None of the Default Policies are working on
the user side. Is there a setting to enable this?

Dave Marden

MikeF
Wed Feb 04 18:14:59 CST 2004

Dave,

Draw a little diagram of your domain structure, like

MYSITE (include this if you have any policies linked to the site, if
not, don't bother.)

MyDomain
|
MyOUname
|
MySubOUname
|
My SubSubOUname

Under each container, put the number and name of the GPOs linked to
that container, in the order that they appear in the list. i.e., 1
GPOName, 2 GPOName, etc.

Check all the GPOs to see if they've been set to "No Override"
Check all containers and see if they've been set to "Block
Inheritance"

Meanwhile, (a) I doubt that the size of the template files in SYSVOL
has anything to do with your problem. (b) I thought you mentioned in
your first post that the name of the GPO was John Doe, but didn't see
it in the list in your second or third post????

(c) try this: make your john doe GPO number 1 in the list in which it
appears.
or, set your john doe GPO to no override.

Mike

"Dave Marden" <anonymous@microsoft.com> wrote in message
news:OzW%23Lkm6DHA.1948@TK2MSFTNGP12.phx.gbl...
> I have been asking this question in Windows SBS 2003 newsgroups
so far
> to no avail, thought maybe someone here could help me.
>
> I have been trying to figure this out. I have Windows Server
2003, and
> I cannot get my personalized GPO's to work.
>
> My client PC's are XP Pro, I have added 1 restriction for 1
user, just
> to try to make it work. What I did is enforced Prohibit access to
control
> panel (I figured it would be easy to check). I created a GPO named
John
> Doe, then I put it last in the list under domainname.local, which
happens to
> be 7. Upon logging on as John Doe the control panel is still
present. I
> checked it on a client computer. The users are in the SBSUsers OU,
and I
> put the GPO link in (MyBusiness/Users).
>
> What I want to do is be able to set restrictions on the users in
my
> domain.
>
> I went into Group Policy Relusts, and upon generating results on
this
> Policy, and under Applied GPO's it doesn't even show up, and under
Denied
> GPO's, it also doesn't show up.
>
> What am I doing wrong?
>
> I can't seem to figure this out and would really appreciate any
help you
> could give me.
>
> Any help appreciated,
> Dave Marden
(david@nospam.mardenfamily.com)
>
>

Dave
Wed Feb 04 18:53:12 CST 2004

Mike,
I believe I did that in the post above on 2/3/2004 at 7:38AM, when it
comes to showing the structure anyways. As for the name, I just said John
Doe, kind of like saying mybusiness.local. Just a generic name, didn't
figure the exact name really mattered. As for overide and block
inheritance, they are not enabled as the computer settings are being
inherited. Like my previous post mentions, I noticed that no user
properties were being accepted but the computer one were.

Like the structure on 2/3/2004 shows, my policy is in the most child OU
so, the order is automatic, since I do not have Enforced enabled on any of
the policies.

Their are a few other User settings in the default GPO's, none of which are
the control panel setting, so it should be allowed to be set by my GPO even
if it is overidden. Like I said previously, I noticed that all of the
default GPO's Are not being allowed to activated for the individual users.
Thier must be a setting somewhere for this.

Dave Marden



"MikeF" <wallacestevens54@removethisfirstyahoo.com> wrote in message
news:ucd0S036DHA.3288@TK2MSFTNGP11.phx.gbl...
> Dave,
>
> Draw a little diagram of your domain structure, like
>
> MYSITE (include this if you have any policies linked to the site, if
> not, don't bother.)
>
> MyDomain
> |
> MyOUname
> |
> MySubOUname
> |
> My SubSubOUname
>
> Under each container, put the number and name of the GPOs linked to
> that container, in the order that they appear in the list. i.e., 1
> GPOName, 2 GPOName, etc.
>
> Check all the GPOs to see if they've been set to "No Override"
> Check all containers and see if they've been set to "Block
> Inheritance"
>
> Meanwhile, (a) I doubt that the size of the template files in SYSVOL
> has anything to do with your problem. (b) I thought you mentioned in
> your first post that the name of the GPO was John Doe, but didn't see
> it in the list in your second or third post????
>
> (c) try this: make your john doe GPO number 1 in the list in which it
> appears.
> or, set your john doe GPO to no override.
>
> Mike
>
> "Dave Marden" <anonymous@microsoft.com> wrote in message
> news:OzW%23Lkm6DHA.1948@TK2MSFTNGP12.phx.gbl...
> > I have been asking this question in Windows SBS 2003 newsgroups
> so far
> > to no avail, thought maybe someone here could help me.
> >
> > I have been trying to figure this out. I have Windows Server
> 2003, and
> > I cannot get my personalized GPO's to work.
> >
> > My client PC's are XP Pro, I have added 1 restriction for 1
> user, just
> > to try to make it work. What I did is enforced Prohibit access to
> control
> > panel (I figured it would be easy to check). I created a GPO named
> John
> > Doe, then I put it last in the list under domainname.local, which
> happens to
> > be 7. Upon logging on as John Doe the control panel is still
> present. I
> > checked it on a client computer. The users are in the SBSUsers OU,
> and I
> > put the GPO link in (MyBusiness/Users).
> >
> > What I want to do is be able to set restrictions on the users in
> my
> > domain.
> >
> > I went into Group Policy Relusts, and upon generating results on
> this
> > Policy, and under Applied GPO's it doesn't even show up, and under
> Denied
> > GPO's, it also doesn't show up.
> >
> > What am I doing wrong?
> >
> > I can't seem to figure this out and would really appreciate any
> help you
> > could give me.
> >
> > Any help appreciated,
> > Dave Marden
> (david@nospam.mardenfamily.com)
> >
> >
>
>

MF
Thu Feb 05 01:49:01 CST 2004

reply inline

"Dave Marden" <anonymous@microsoft.com> wrote in message
news:ugGrbJ46DHA.4012@tk2msftngp13.phx.gbl...
> Mike,
> I believe I did that in the post above on 2/3/2004 at 7:38AM, when it
> comes to showing the structure anyways.

it looked like you reproduced results from gpresults, aka RSOP.
you should do it manually. the cause of this kind of problem is often
simple. simplicity of approach is most likely to find it. ZEN!!

As for the name, I just said John
> Doe, kind of like saying mybusiness.local. Just a generic name, didn't
> figure the exact name really mattered.

well, generally speaking, the less accurate, the less accurate/

As for overide and block
> inheritance, they are not enabled as the computer settings are being
> inherited. Like my previous post mentions, I noticed that no user
> properties were being accepted but the computer one were.

> Like the structure on 2/3/2004 shows, my policy is in the most child
OU
> so, the order is automatic, since I do not have Enforced enabled on any of
> the policies.

did you move the policy you want to make happen up to number one? number
one has the highest priority.
failing that, did you set the policy you want to no override, or enforce?
>
> Their are a few other User settings in the default GPO's, none of which
are
> the control panel setting, so it should be allowed to be set by my GPO
even
> if it is overidden.

to quote ms. and this is a direct quote, "generally, computer settings
override user settings."

Like I said previously, I noticed that all of the
> default GPO's Are not being allowed to activated for the individual users.
> Thier must be a setting somewhere for this.

there are two: one you can find in GPMC, and the other is loopback, which as
i recall you can find on the container. these could have got bollixed but
that seems improbable.

go here to see if there is joy:
http://www.microsoft.com/downloads/details.aspx?FamilyID=b24bf2d5-0d7a-4fc5-a14d-e91d211c21b2&DisplayLang=en

Mike

>
> "MikeF" <wallacestevens54@removethisfirstyahoo.com> wrote in message
> news:ucd0S036DHA.3288@TK2MSFTNGP11.phx.gbl...
> > Dave,
> >
> > Draw a little diagram of your domain structure, like
> >
> > MYSITE (include this if you have any policies linked to the site, if
> > not, don't bother.)
> >
> > MyDomain
> > |
> > MyOUname
> > |
> > MySubOUname
> > |
> > My SubSubOUname
> >
> > Under each container, put the number and name of the GPOs linked to
> > that container, in the order that they appear in the list. i.e., 1
> > GPOName, 2 GPOName, etc.
> >
> > Check all the GPOs to see if they've been set to "No Override"
> > Check all containers and see if they've been set to "Block
> > Inheritance"
> >
> > Meanwhile, (a) I doubt that the size of the template files in SYSVOL
> > has anything to do with your problem. (b) I thought you mentioned in
> > your first post that the name of the GPO was John Doe, but didn't see
> > it in the list in your second or third post????
> >
> > (c) try this: make your john doe GPO number 1 in the list in which it
> > appears.
> > or, set your john doe GPO to no override.
> >
> > Mike
> >
> > "Dave Marden" <anonymous@microsoft.com> wrote in message
> > news:OzW%23Lkm6DHA.1948@TK2MSFTNGP12.phx.gbl...
> > > I have been asking this question in Windows SBS 2003 newsgroups
> > so far
> > > to no avail, thought maybe someone here could help me.
> > >
> > > I have been trying to figure this out. I have Windows Server
> > 2003, and
> > > I cannot get my personalized GPO's to work.
> > >
> > > My client PC's are XP Pro, I have added 1 restriction for 1
> > user, just
> > > to try to make it work. What I did is enforced Prohibit access to
> > control
> > > panel (I figured it would be easy to check). I created a GPO named
> > John
> > > Doe, then I put it last in the list under domainname.local, which
> > happens to
> > > be 7. Upon logging on as John Doe the control panel is still
> > present. I
> > > checked it on a client computer. The users are in the SBSUsers OU,
> > and I
> > > put the GPO link in (MyBusiness/Users).
> > >
> > > What I want to do is be able to set restrictions on the users in
> > my
> > > domain.
> > >
> > > I went into Group Policy Relusts, and upon generating results on
> > this
> > > Policy, and under Applied GPO's it doesn't even show up, and under
> > Denied
> > > GPO's, it also doesn't show up.
> > >
> > > What am I doing wrong?
> > >
> > > I can't seem to figure this out and would really appreciate any
> > help you
> > > could give me.
> > >
> > > Any help appreciated,
> > > Dave Marden
> > (david@nospam.mardenfamily.com)
> > >
> > >
> >
> >
>
>

Dave
Thu Feb 05 07:50:36 CST 2004



> it looked like you reproduced results from gpresults, aka RSOP.

> you should do it manually. the cause of this kind of problem is often

> simple. simplicity of approach is most likely to find it. ZEN!!



I manually obtained this information from the Group Policy Management
Console Tree on the left pane.



>

> As for the name, I just said John

> > Doe, kind of like saying mybusiness.local. Just a generic name, didn't

> > figure the exact name really mattered.

>

> well, generally speaking, the less accurate, the less accurate/



I will try to be more specific next time.



> did you move the policy you want to make happen up to number one? number

> one has the highest priority.

> failing that, did you set the policy you want to no override, or enforce?


Yes it is number one and was already number 1.



> > Their are a few other User settings in the default GPO's, none of which
are

> > the control panel setting, so it should be allowed to be set by my GPO
even

> > if it is overidden.

>

> to quote ms. and this is a direct quote, "generally, computer settings

> override user settings."


This is the only place in my entire domain where this particular policy has
been put into. I do not believe that computer settings have the Control
Panel Setting, so I don't see where this pertains to my problem.



> Like I said previously, I noticed that all of the

> > default GPO's Are not being allowed to activated for the individual
users.

> > Thier must be a setting somewhere for this.

>

> there are two: one you can find in GPMC, and the other is loopback, which
as

> i recall you can find on the container. these could have got bollixed but

> that seems improbable.



1. I did some searching for loopback and found it in the GPO's under:

-> Computer Settings

-> Administrative Templates

-> System

-> Group Policy

User Group Policy loopback processing mode

Anyway, you were right and this was not enabled.

2. I cannot find what you are talking about on the container, unless you are
referring to enabling the GPO.

>

> go here to see if there is joy:

>
http://www.microsoft.com/downloads/details.aspx?FamilyID=b24bf2d5-0d7a-4fc5-a14d-e91d211c21b2&DisplayLang=en

I will read this white paper, and let you know what I find.

Thanks Again,

Dave Marden

Dave
Fri Feb 06 10:09:12 CST 2004

MF, I found the answer in the Microsoft White Papers. I had a DNS
problem, I was pointing my clients at my ISP's DNS addresses instead of
pointing them at the server.

Thanks for all the help, without you pointing me in the direction of the
white papers, I would still be struggling through this.

Dave Marden

MikeF
Fri Feb 06 23:16:12 CST 2004

Good, glad to hear it. I've told others to always check dns first,
because it causes lots of problems with AD installations that the
error messages do not point to. But forgot to mention that to you.
Given the endless reams of support msft provides, you'd think they'd
come up with more informative error messages, but they've had 20 years
to do it, so they won't.

good luck with your installation.
Mike
"Dave Marden" <anonymous@microsoft.com> wrote in message
news:ejP5%23tM7DHA.1596@TK2MSFTNGP10.phx.gbl...
> MF, I found the answer in the Microsoft White Papers. I had a
DNS
> problem, I was pointing my clients at my ISP's DNS addresses instead
of
> pointing them at the server.
>
> Thanks for all the help, without you pointing me in the direction of
the
> white papers, I would still be struggling through this.
>
> Dave Marden
>
>