3

Preface: I have enough privileges to create GPOs in my OU, and have made a few of them for some simple tasks (like deploying a printer to certain users). Not actually a sysadmin...I'm a developer who is winging it.

I wanted to create a GPO that would set a mapped folder for a certain security group (which I recently created and that contains only myself). Did the following:

  • Created the GPO in MyOU -> Users
  • Removed the default Authenticted Users under Security Filtering
  • Add the security group with my account to Security Filtering
  • Set up the mapping via the User Configuration option
  • Changed GPO Status to "Computer configuration settings disabled"
  • Left WMI filtering to

Closed the GPO at this point...

  • Logged in as the target user; ran gpupdate /force
  • Logged out, logged in, ran gpresult /r, no mention of my GPO
  • Rebooted
  • Logged in, re-ran gpupdate /force
  • Logged out, logged in, ran gpresult /r, still no mention of my GPO

If I log in with another completely different user, their RSOP information shows that the new GPO is being ignored due to a security restriction, so it appears to be "working" for other users. I just can't get it to actually show up in RSOP for the user it should be working.

Is there anything else I can do short of rebooting endlessly and crossing my fingers?

Improve this question

3 Answers 3

Reset to default
1

You mention that you removed the default "Authenticated Users" from the Security Filtering. Have you added your account to Security Filtering? If not, you will need to do so, for the policy to apply to your account.

Improve this answer
4
  • Yes, via the Security Group that I created and added my account to.
    – ihavenoideawhatimdoing
    Apr 5, 2012 at 17:02
  • Are you the user, that you want it to map for? Or is that another user?
    – HostBits
    Apr 5, 2012 at 17:28
  • I am the user I want to map for. Eventually more, but using myself as a test case.
    – ihavenoideawhatimdoing
    Apr 5, 2012 at 17:38
  • Run Group Policy Results from the GPMC, I'm thinking you've got something borked with the SOM for the GPO.
    – joeqwerty
    Apr 5, 2012 at 17:51
0

The user account that you're testing with is beneath the OU that you're applying the policy to, isn't it?

Improve this answer
2
  • It is not! Is this the issue? The OU my computers are in is basically MyOrg -> MyDivision -> MyDept -> Computers. Appears ALL users are in MyOrgUsers -> Users -> SomeFolder -> {0-9}{a-c}{d-f}{etc...}. Though I'm still a bit confused since my printer GPO worked, and that was user-based just as this one is.
    – ihavenoideawhatimdoing
    Apr 6, 2012 at 15:00
  • The user portion of the policy will only apply to the users if their user account are in or below the OU that the policy applies to. The exception to this is when you're using Loopback Processing. Is your printer GPO applied at the domain level? If so that will apply to all users in your domain anyway.
    – Chris McKeown
    Apr 6, 2012 at 19:21
0

Have you linked and enforced the policy's back to the default domain policy? You may also want to look at the link order as this is the order (1 being the highest) that policies are applied in.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .