4

I have a new OU (natorg.local\NATO\Users) that I am trying to apply GP to. I have created a new user in this OU, and linked the 3 GPO's to this OU:

DESKTOP - Folder Redirection (AppData)
DESKTOP - Folder Redirection (Desktop)
DESKTOP - Folder Redirection (Documents)

Hopefully the names are sufficient to suggest what they do exactly. The settings are under User Settings so there is no Loopback processing required (if my understanding is correct).

GP Modelling for the user and specific computer says that the GPOs will/should be applied, however on the client, gpresult doesn't even appear to see the GPOs under either "Applied" or "Not Applied":

USER SETTINGS
--------------
    CN=Amir,OU=Users,OU=NATO,DC=natorg,DC=local
    Last time Group Policy was applied: 25/06/2012 at 11:07:13 AM
    Group Policy was applied from:      svr-addc-01.natorg.local
    Group Policy slow link threshold:   500 kbps

    Applied Group Policy Objects
    -----------------------------
        LAPTOPS - Power Settings
        WSUS - Set Server Address
        OUTLOOK - Auto Archive
        SECURITY - Lock Screen After Idle
        Default Domain Policy
        DESKTOP - Regional Settings
        NETWORK - Proxy Configuration
        NETWORK - IE General Config
        OFFICE - Trusted Locations
        OFFICE - Increase Privacy
        OUTLOOK - Disable Junk Filter
        DESKTOP - Disable Windows Error Reporting
        DESKTOP - Hide Language Bar
        NETWORK - Disable Skype
        DESKTOP - Disable Thumbs.db Creation
        WSUS - Set Server Address

    The following GPOs were not applied because they were filtered out
    -------------------------------------------------------------------
        Local Group Policy
            Filtering:  Not Applied (Empty)

        NETWORK - Google Chrome Configuration
                Filtering:  Not Applied (Empty)

        SYSTEM - Event Log Configuration
            Filtering:  Not Applied (Empty)

        SECURITY - Local Administrator Password
            Filtering:  Not Applied (Empty)

        NETWORK - Disable Windows Messenger
            Filtering:  Not Applied (Empty)

        SECURITY - Audit Policy
            Filtering:  Not Applied (Empty)

        WSUS - Automatic Install
            Filtering:  Not Applied (Empty)

        NETWORK - Firewall Configuration
            Filtering:  Not Applied (Empty)

        DESKTOP - Enable Offline Files
            Filtering:  Not Applied (Empty)

I haven't altered permissions on the GPO's at all, no WMI filtering... As I said, GP Modelling says that they should be applied. GPResult on the client correctly identifies itself as being the correct OU (CN=Amir,OU=Users,OU=NATO,DC=natorg,DC=local)

There are 2 x 2008R2 and a 2003 DC, domain is 2003 level, client is Windows XP SP3.

Can anyone suggest why these GP Objects would be "invisible" to the client?

3
  • 1
    Have you logged off and on as the user in question? Folder Redirection doesn't occur during group policy refresh or by using gpupdate. Folder Redirection only occurs at user logon.
    – joeqwerty
    Jun 25, 2012 at 4:51
  • @joeqwerty Yes, logged off and on many times, rebooted, installed all updates. It appears it's the specific client though, the GPO works for the same user on another machine. I have re-imaged the machine and will test again shortly.
    – fukawi2
    Jun 25, 2012 at 11:34
  • OK, so I've completely reloaded the client and the same problems persists. I'm miffed :(
    – fukawi2
    Jun 26, 2012 at 0:57

2 Answers 2

1

OK, I don't pretend to understand this, but the problem was a separate GPO with User Settings (Power Profiles) linked to the computer's OU with Loopback enabled in "Replace" mode.

Disabling that specific GPO allowed the new GPO's to be "seen" by the client.

2
  • As a side note, you could also set the policy with the loopback enabled to 'merge' mode Aug 8, 2014 at 22:58
  • Ah, the old "Replace\Merge" issue. This should help you understand what was going on a bit better. Basically, replace mode wipes out the user settings and forces the settings in the user side to take effect even though the policy is applied to a computer. Merge adds the settings to the normal user settings applied to the user account. Aug 27, 2014 at 20:24
0

Check to make sure the computer is not in a container that blocks any group policies. I would even go as far as deleting the computer object and readding the device to the domain.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .