Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm having some problems with a newly installed Server 2008 R2 box.

I've created my Domain and users and all the computers are up and connected.

Everyone can login and share folders, no problems here.

I've now edited the Default Domain Policy, with a couple of changes to the security. (Don't save last logged in username) and a couple of other basic ones. - I will create a new policy for more advanced GPO stuff.

Anyhow - this is not applying to our machines. They are all XP, I've tried running gpupdate /force - on both server and PCs, logged in as a user and logged in as the administrator.

share|improve this question

First ... DON'T SCREW AROUND WITH THESE THINGS IN PRODUCTION. Group Policy does not always work the way you think it will work. The very last thing you want to do as a rookie is change the Default Domain policy! Create a test OU and test user, put the computer and user in the test OU, and experiment there.

Second, I will ask the obvious ...

1- Is the Group Policy Object actually linked to an OU at or above where the computers and/or users reside?

2- Is there any security filtering or WMI filtering activated on the policy? You can see this on the "scope" tab when you highlight the policy.

3- Is the GPO status "Enabled"? You can see the status on the "Details" tab. It is generally best, particularly for those less experienced with GPO, to not try and tune the "user settings disabled" and/or "computer settings disabled" options and just enable the policy.

Third, in the Group Policy Management console, there is a "Group Policy Modeling Wizard" applet (under the Action menu) that will show specifically what is applied and what isn't based on the user and computer. Run it, select the user and computer, and see what happens.

Finally, if the wizard shows that the policy should be applied, try restarting the computer. Policy changes sometimes take a reboot to apply, and gpupdate /force doesn't always force.

Good luck. You are entering the world of advanced Windows network wizardry!

share|improve this answer

Try using RSOP from the GPMC to see if the policy if the policy is showing as applied.

It is possible that a permission or WMI condition is causing the policy to be filtered.

share|improve this answer
Hi Bryan - How do I run RSOP from GPMC for a specific user/pc? – MikeT505 Apr 18 '11 at 11:40
Just type rsop.msc in the Run dialog, or on the command line. To change the user/computer you want to query, right-click the root of node in rsop (labled %USER% on %COMPUTER% - RSoP) and choose "Change Query..." – jscott Apr 18 '11 at 12:19
the recommended method is to run "gpresult /h" on client machines. RSOP is depreciated. – strongline Jun 10 '15 at 14:17

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.