1

I am trying to set all the systems on my test network (1 x Win Server 2008 R2, 2 x Win XP SP3, 2 x Win 7) so that Remote Admin Mode is enabled, but I am having difficulty doing this with the XP systems.

I started by setting up a GPO and assigning it to the computers in a test OU (which contains all of them). The GPO has remote admin enabled (supposedly) in Group Policy Management Editor -> Computer Configuration -> Policies -> Administrative Templates -> Network -> Network Connections -> Windows Firewall -> Domain Profile (and Standard) -> Allow inbound remote administration exception ENABLED.

Once I have this set I go to a Win7 system and at the command prompt type GPUPDATE /force, and straight away if I type 'netsh firewall show state' the Firewall Status table comes up with

  • Group policy version = Windows Firewall
  • Remote admin mode = Enable

I can disable it with the expected results too. But if I do the same thing with an XP SP3 system, I always get

  • Group policy version = None
  • Remote admin mode = Disable

Even if I restart the XP systems twice, restart the server, GPUPDATE / force, left it overnight, it never changes. What am I doing wrong that the XP systems ignore the GPO? No other policies exist that could be overriding it. On the local system I can type 'netsh firewall set service RemoteAdmin enable' and it works just fine. I have also added the same setting to the default Domain Policy.

Why would the XP systems be ignoring the GPO? I have been struggling with this for half a day... Any advice would be greatly appreciated!

Improve this question
1
  • 2
    Run gpresults against one of the Windows XP machines and see which GPO's are being applied and denied, and why.
    – joeqwerty
    Jul 31, 2011 at 14:18

1 Answer 1

Reset to default
4

In almost all cases like this I've seen one of two problems is occurring:

  • Group Policy isn't being applied because of DNS / network connectivity issues (external-to-AD DNS servers specified on the PCs, DHCP media sense causing the NIC not to come up early enough in boot to apply machine policy)

  • You think the policy will apply but Windows thinks it doesn't

Have a look at Resultant Set of Policy (rsop.msc) on one of the affected machines and, if you're so inclined, post the output of a gpresult as @joeqwerty suggests.

Check the Application Event Log for errors relating to Group Policy application (source USERENV) and possibly from the "NETLOGON" source. If the NIC isn't coming up fast enough you'll see errors there right after boot (errors about not being able to locate a domain controller, typically). I've found that some machines (from name-brand manufacturers of a recent vintage) need to have the DisableDHCPMediaSense value set to apply Group Policy right. Before you set that, though, make sure the switch ports aren't sitting in a Spanning Tree Protocol (STP) "Listening / Learning" state when the PC first brings the NIC up (in Cisco parlance, make sure the port is set to enable spanning tree "portfast").

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .