Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've taken over from an IT outsourcer and have found a struggle now that we're starting a migration to windows 7. Someone decided that they would setup Folder redirection in the Default Domain Policy. I've since configured redirection in another policy at an OU level.

No matter what I do, the windows 7 systems pick up the Default Domain Policy folder redirection settings only. I keep getting entries in the event log showing that the previously redirected folders "need to be redirected" with a status of 0x80000004. From what I can tell this just means that it's redirecting them locally.

Is there a way I can wipe that section of the GPO clean so it's no longer there? I'm hesitant to try to reset the default domain policy to complete defaults.

***UPDATE 6-26

I found that the following condition occurred and was causing the grief here. I've already implemented the new policies for clients, and for some reason, XP was working great, 7 was refusing to process. The DDP was enforced. Because of this, and the fact that the folder redirection policies were set to redirect back to the local profile upon removal, it was forcing clients to pick up it's "redirect to local" settings.

Requirements for to recreate the issue. -Create a new test OU and policy. -Create some folder redirection settings, set them to redirect to local upon removal -Remove settings on that GPO -Refresh your view of the GPO and check the settings. -You'll notice that the settings show "not configured" entries for folder redirection. -Enforce this GPO -Create another sub-OU -Create a GPO linked to this sub-ou and configure some folder redirection settings. -Watch as the enforced GPOs "not configured" setting overrides the policy you just defined.

I've had to relink the DDP to all OU's that have "block inheritance" enabled, and disable the "enforced" option on the DDP as a workaround. I'd love to re-enable enforcement of the DDP, but until I can erase the traces of folder redirection settings from the DDP, I think I'm stuck.

share|improve this question
1  
I know it doesn't answer your question, but resetting the default domain policy now will save you from wondering if the non-standard settings in DDP is causing other bits of havoc. –  Richard Slater Jun 24 '10 at 20:19
    
There is an option on the settings tab of the Folder Redirection policy as to what to do when the policy is removed. What option was selected in the Default domain policy? –  joeqwerty Jun 24 '10 at 21:17
    
Richard - Resetting the DDP using the dcgpofix will likely cause more trouble than it's worth. Even MS's KB article on the subject has a long list of policy settings that will not be configured correctly. Not to mention it's a bit like using a hammer to kill a fly.. joeqwerty - I'm going to play around with that a bit. Perhaps reconfiguring redirection in the DDP with a "leave this alone when removed" option will cause it to completely be removed when I disable the settings. Will report results if successful! –  bruor Jun 26 '10 at 14:54

5 Answers 5

I had the exact same problem. I also tried deleting fdeploy.ini file and got a message in GPMC that it failed to locate the settings, so clearly they're defined there but some setting elsewhere is enabling those settings and pointing to that file.

While I haven't found a way to completely remove the settings, I did find a better workaround. Instead of unticking Enforce on the DDP, expand the Group Policy Objects folder, right-click the DDP, and under the GPO Status submenu tick User Configuration Settings Disabled.

This will let you leave the DDP enforced without any ill effect since there are no user settings in the DDP. It isn't pretty and I'd still like to know how to get rid of the settings entirely, but it will get the policy to function correctly.

share|improve this answer

your trying to migrate users one at a time correct? So you move the users into this ou that you created a new gpo for correct? And during this you don't want to hose up other users correct? If these are all true then create another gpo that matches the ddp folder redir settings and place it higher up the ou structure thus impacting all users. Then remove the ddp settings for Folder redirect. At that point your new gpo settings will apply to the users within the ou that you created all the other users will get the old folder redir settings.

please verify this process yourself it can cause one helluv a lot of problems if not done correctly !

share|improve this answer
    
Not correct, see edits in question for more details on the current config. –  bruor Jun 26 '10 at 14:54
    
I don't know of a difference between win7 and xp that are influenced by inheritance,enforcement and overide etc.. So the fact that xp works and 7 doesn't means to me that I'd be checking the config of the win7 workstations. –  tony roth Jun 28 '10 at 14:58

Since Community decided to necro this one...

Migrate data from the machines and reimage them. Sounds like that environment is the wild west anyway. Just wipe and start fresh.

share|improve this answer

In order to remove the Folder Redirection settings from a GPO properly, you need to:

  • As mentioned by other people here, remove the Documents and Settings folder under \\domain\sysvol\Policies\{GPO GUID}\User and the fdeploy.ini and fdeploy1.ini files contained within.

However, on its own, this will confuse the GPO Editor as it still thinks there's a Folder Redirection policy attached to the GPO. To solve this, you need to remove the association between the GPO and the Folder Redirection Group Policy Extensions (there are two, one which activates Folder Redirection editing in the GPO Editor, the other activates the actual Folder Redirection policy processing):

  • Open AD Users and Computers. Turn on Advanced Features (View->Advanced Features). Navigate to System->Policies->{GPO GUID}. Right click on {GPO GUID}, choose Properties. In the dialog that pops up, switch to Attribute Editor. Scroll down to gPCUserExtensionNames, and double click it.

  • This will pop up a dialog with a long text entry box, and a bunch of GUIDs. This attribute defines the list of GP Extensions associated with this GPO in the User context. Immediately above it you'll see the related attribute gPCMachineExtensionNames which defines the associated GP extensions in the Machine context of the GPO.

  • Delete the following entry from gPCUserExtensionNames : [{25537BA6-77A8-11D2-9B6C-0000F8080861}{88E729D6-BDC1-11D1-BD2A-00C04FB9603F}]

  • Note that associated GP Extensions are grouped by square brackets [].

  • Do not touch any other entries in the attribute, or you will break other functionality in the GPO.

  • Click OK, and you're done.

  • If you're interested in what GP Extension is associated with each GUID, simply use regedit to search the registry for that GUID - e.g. try searching for 25537BA6-77A8 or 88E729D6-BDC1.

share|improve this answer

Find the GUID/(Unique name) of the policy and go to \(your domain)\sysvol\Policies{GUID}\User\Documents & Settings\ and it should be there.

Be very careful/backup etc.

share|improve this answer
    
I did find the fdeploy.ini in that location. However, you can't remove all entries, or the entire file or the policy shows an error under the section where those settings were defined at one time. –  bruor Jun 26 '10 at 14:40

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.