Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am having trouble applying group policies on computers with deep freeze installed on them. They are domain joined and pulling updates from our WSUS server before being frozen. When we freeze them they seem to lose their group policy settings. I have tried thawing, gpupdate/ force, and then refreezing, but they lose their group policy as soon as they are brought back up. What could be causing this? Everything was working fine until a bad Windows update came through. We blocked the update on our WSUS server and thawed, removed the update, and re-froze all the computers. The next day I came to work to find out that all the computers had reached out to the Internet and pulled the bad update again.

share|improve this question
    
On boot and logon stuff happens, like refreshing GPOs, which in turn writes to your C:\windows\system32\GroupPolicy. When taking the snapshot with Deep Freeze, are you sure that there are files located in that directory? Otherwise, they will be "removed" by Deep Freeze upon reboot, obviously. You can enable symmetric logons, but this will slow down the logon process (HKLM\Software\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon REG_DWORD:SyncForegroundPolicy). Sounds ironic since it's a GPO, but maybe control this reg value in your image? –  mbrownnyc Oct 19 '11 at 16:52
add comment

2 Answers

What exactly is the group policy setting (or settings) being lost? Deep Freeze will keep the settings on the machine as they were (unless they're updated during, say, a maintenance window), but it can still be overridden at runtime. Just like with viruses. Deep Freeze will protect the machine from infection in that when you reboot, it's gone; but it can still be infected during runtime.

Also if there are alterations during runtime the policy may get overridden. I.e., user-specific settings from their portions of the registry (pulled from a profile) will take effect at login, just like if they have malware in their profile it'll infect the machine each time they log in and get wiped when restarted (assuming the profile isn't part of the freeze state.)

The bad update shouldn't matter if the machine is frozen. Restarting will eliminate it, unless they're doing it over a maintenance thaw. One solution to that is to either alter your DNS records so you can't reach the Windows Update server except from your WSUS server (not a great solution) or blocking access at a proxy or firewall except for your server.

share|improve this answer
    
The machines are scheduled to thaw every night at 1 am, pull updates from wsus, then freeze again at 4 am. The bad update is blocked on our wsus server, but the machines keep pulling the bad update from windows when they thaw instead of hitting wsus. The policy that turns off automatic updates is not being applied... I can force it but as soon as I refreeze, the machine loses the policy. All of our staff and faculty computers that do not have deep freeze are taking the gpo like they are supposed to, so I'm assuming it's a conflict with deepfreeze. –  John Bathers Oct 19 '11 at 17:13
    
Interesting. I'd almost think there's corruption with a registry hive doing it, if you only had this happen to select machines that had the update on them first. –  Bart Silverstrim Oct 19 '11 at 17:35
1  
DF itself shouldn't be affecting policy. We've had corrupted hives do weird things, though. And it's odd that it's tied to that update going on the system first. –  Bart Silverstrim Oct 19 '11 at 17:47
add comment

I don't know the answer about Deep Freeze but this is the kind of problems that this type of software generates. The software freeze the machine in a point of the time, and everything you do is lost when the machine is restart. That is bad thing because machines stops to taking changes of important things like updates. These type of software let you make execptions to dont have this issues, but in lots of cases still fails.

Some time ago Microsoft had a software like this called Steady State for Windows Xp but for Windows 7 it was disccontinuated.

¿Why? Because this kind of software is not necessary. With Windows natively you can have mandatory profiles, a type of user profile that lost all the changes when the user close his session.

So my recommendation here is dont use Deep Freeze, Windows natively can do to a similar behavior with lots of advantages for free. Microsoft has a guide to do this using GPos and mandatory profiles: Creating a Steady State by Using Microsoft Technologies

share|improve this answer
    
Deep Freeze offers benefits that you don't find with mandatory profiles. For example, when you have someone mucking with the Windows directory, deep freeze means nothing is altered after reboot. Users with mandatory profiles can in some cases still alter outside directories and files, and malware can take advantage of exploits in the system. With DF, the damage is limited to just the user profile and home directories. –  Bart Silverstrim Oct 19 '11 at 16:14
1  
@BartSilverstrim this is true only for admin users, but in a traditional enviroment like describe in the guide above a User NEVER can change a Windows Directory or a local machine registry hive. About the virus you are right, but if you freeze your machine lots of times your antivirus wont be update and you will have lots of issues when the machine starts. –  Ricardo Polo Oct 19 '11 at 16:18
    
Additionally, there are cases where for some reason the profile/gpo doesn't "take". If a system isn't communicating with the network properly, DF still protects the machine from tampering. –  Bart Silverstrim Oct 19 '11 at 16:19
    
If the machine isn't communicating with the network properly GPOs are not affected becase they are cached until the next contact with the DC. –  Ricardo Polo Oct 19 '11 at 16:22
    
Not if the new GPO is what you need on the machine. –  Bart Silverstrim Oct 19 '11 at 16:49
show 6 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.