Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm experimenting with Group Policy settings. My DC is running Server 2003, and the client I am using for this test is running Win7. I've restarted the client a few times, and tried running gpupdate/force for good measure.

This machine is in it's own OU with a group policy applied to change one setting, Computer Configuration/Administrative Templates/Network/Offline Files.

When I run MMC and look at Local Computer Policy on the client this setting shows up as "not configured".

Thanks, John

share|improve this question

2 Answers 2

You won't see the results of Group Policy Administrative Template application in Local Computer Policy. You want to be using the "Resultant Set of Policy" tool to see what GPOs are applying to the computer.

If you're not seeing the GPO(s) you expect to be applying to the client computer, review the Application and System event logs and be sure that you're getting good name resolution and not seeing any errors related to Group Policy application. Bad DNS settings on clients are notoriously the cause of Group Policy failing to apply.

share|improve this answer
    
Indeed. The Event Log should be well spammed with events if it can't find where to download the policies. –  sysadmin1138 May 13 '10 at 19:13

A couple other things to check. Ensure that a group your computer is a member of, like Domain Users, is allowed the Read and Apply Group Policy permissions on the security of the GPO. Also, is the client on the same site as the domain controller, or across a WAN? If the connection to the domain controller is detected as slow, this can inhibit application of the GPO. I've seen false "slow link" readings be triggered if UDP fragmentation is disabled on the WAN link, as detection on older platforms (pre-Vista) uses large ICMP messages (2048 bytes) and measures round trip time. The new method with Win7 is more reliable but more complex, requiring authenticating to a DC specifically via Kerberos, and I'm not sure if it will fall back to the old method. A solution is to manually disable slow link detection at the client side.

Some Win7 slow link detection discussion, very good: http://blogs.technet.com/b/askds/archive/2009/10/23/group-policy-slow-link-detection-using-windows-vista-and-later.aspx

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.