Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have two policies which are supposed to modify the setting, and the they do not seem to be proccessed the way I believe they should.

The two policies control the the visibility of the administrative tools on the start menu setting.

Show_Admin_Tools:

  • Applies to Domain Admins, and nothing else
  • Linked at the root only
  • Link order position = 1

Hide_Admin_Tools:

  • Applies to Authenticated Users
  • Linked at the root only
  • Link order position = 2

There is no loopback processing, policies are not enforced, and inheritence is not blocked.

When gpupdate is run as an administror... the Administrative Tools link does not show on the Start Menu. If it is manually turned on, it is removed again at GP refresh. Checking Group Policy results on a machine shows shows three GPO applications, in the following sequence: first the Authenticated Users GPO, then the Domain Admins GPO, then the Authenticated Users GPO again.

Unfortunately, I am unable to provide a graphic of the GP result, due to security issues.

Can anyone explain why the Authenticated Users GPO would apply last, even though it has already been applied and the link order seems to suggest that the show tools policy should take precedence? How do I use group policies to display the admin tools for admins, and hide them for everyone else?

share|improve this question
    
In GPMC double check the GPO link order and inheritance. The GPO with the lowest link order number has the highest precedence. Make sure the link order and inheritance is as you expect them to be. –  joeqwerty Oct 5 '11 at 19:02
    
As I stated in my original question, link order is set so domain admins GPO is at 1, and authenticated users is at 2. Both are at root. I'm trying to figure out why a machine would apply the authenticated users, then the domain admins, THEN the authenticated users again, especially if both GPOs are linked only ONCE at the domain root. –  newmanth Oct 6 '11 at 17:42
    
The only thing I can think is that it has something to do with the Authenticated Users group (although I don't know why that would cause GP to apply the GPO twice), as Domain Admins are members of the Authenticated Users group. Try configuring Security Filtering on the AU GPO to use a different group that everyone other than Domain Admins are a member of. Secondly, the Domain Admins GPO configures the Start Menu item, correct? It's not just simply left unconfigured, with the thought that it would "undo" the AU GPO? –  joeqwerty Oct 6 '11 at 17:57

2 Answers 2

up vote 2 down vote accepted

"How do I use group policies to display the admin tools for admins, and hide them for everyone else?"

Add a deny ACE for Domain Admins for "Apply Group Policy" on the Hide_Admin_Tools GPO.

share|improve this answer
    
That worked. I'd give you five upvotes if I could. Absolutely brilliant! –  newmanth Oct 13 '11 at 13:54

Also check you haven't enforced one or more of the policies (yellow lock on the icon), it's not necessary (I'm not sure exactly how it changes precedence). Also, google group policy loopback processing. I have no idea exactly what it does (as it's not necessary in most situations) but it also affects the precedence, so you might want to make sure it's turned off.

share|improve this answer
    
Policies are not enforced. Loopback processing is not a factor, as these user prefs are only defined in these two GPOs –  newmanth Oct 6 '11 at 17:41
    
It's a long shot, but out of interest, have you tried using the Group Policy Results wizard do see what comes of it? It usually tells you the settings that applies and the winning policy and you might see something unexpected in there. –  Dom Oct 8 '11 at 6:11
    
Thanks for the suggestion, but per my original post: Checking Group Policy results on a machine shows three GPO applications, in the following sequence: first the Authenticated Users GPO, then the Domain Admins GPO, then the Authenticated Users GPO again. It is important to note that the GPOs are not linked anywhere else, only once each at the root of the domain tree –  newmanth Oct 11 '11 at 20:28

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.